What Is Two-Factor Authentication, and Why You Should Turn It On Today

Passwords leak. They show up in data breaches, get guessed, get phished, or get reused across so many sites that one leaked login turns into ten compromised accounts. Two-factor authentication (2FA) is the single most effective thing you can do to stop a stolen password from actually being useful to someone else.

What 2FA Actually Means

Two-factor authentication requires two different types of proof before you can log in: something you know (your password) and something you have (your phone, a security key) or something you are (your fingerprint). Even if an attacker learns your password, they still can't get in without that second factor.

This is different from just having a long password or a security question. A security question is still "something you know," so it doesn't add real protection — anyone who can guess or find your password could often answer "what's your mother's maiden name" too. A true second factor lives on a separate device or in a separate app.

The Common Types, from Weakest to Strongest

• SMS codes: a text message with a one-time code. Better than nothing, but vulnerable to SIM-swapping attacks, where someone convinces your carrier to move your phone number to their device.
• Authenticator apps: apps like Google Authenticator or Authy generate a new six-digit code every 30 seconds, based on a secret shared only with the service when you set it up. No signal or carrier involved, which makes this significantly harder to intercept.
• Push notifications: the service sends an "Is this you?" prompt to an app on your phone, and you tap approve or deny. Convenient, but be cautious of "MFA fatigue" attacks, where someone spams you with prompts hoping you'll tap approve by accident or out of annoyance.
• Hardware security keys: small physical devices (like a YubiKey) you plug in or tap. Currently the strongest option, because the key never transmits anything an attacker could phish or replay.

For most people, an authenticator app is the sweet spot: far stronger than SMS, and no extra hardware to buy or lose.

Where to Turn It On First

You don't need to enable 2FA everywhere at once. Prioritize the accounts that would cause the most damage if compromised:

1. Your primary email — it's usually the password-reset gateway to everything else.
2. Your password manager, if you use one.
3. Banking and financial accounts.
4. Any account tied to your identity: social media, cloud storage, work accounts.

Most major services have a "Security" or "Two-Step Verification" section in account settings. The setup is almost always the same: scan a QR code with your authenticator app, enter the six-digit code it generates to confirm, and save the backup codes the service gives you somewhere safe — a password manager, or printed and stored offline. Those backup codes are your lifeline if you ever lose the device your authenticator app is on.

A Second Factor Doesn't Replace a Good Password

2FA is a second layer, not a substitute for the first one. A weak, reused password is still an easy target, and some attacks (like session hijacking) can bypass 2FA entirely if your password was already compromised elsewhere. The two work best together: a long, unique password per site, plus a second factor on the accounts that matter most.

If you're still using passwords you can remember — which usually means they're short or reused — our Strong Password Generator creates long, random, unique passwords in your browser, with nothing sent to a server. Pair one of those with 2FA on your important accounts, and a leaked password stops being a way in.