A password is one lock on your door. This guide shows you how to add a second one, and why passkeys may eventually replace the first. It is part of Everyday passwords. If you are brand new, start with what 2FA is.
Where to begin
You do not need to protect everything today. Start with the accounts that can reset the others, using which accounts need 2FA first.
Choose your method
There are several kinds, and 2FA methods compared sets them side by side:
- Text message codes are better than nothing, but SIM swap attacks can defeat them.
- Authenticator apps are free and strong for everyday use.
- Hardware security keys give the strongest protection for your most important accounts.
- Passkeys replace the password with a key held on your device.
Not sure how they relate? See passkeys vs passwords vs 2FA.
Plan for losing your phone
Two-factor login should never lock you out. Save your backup codes when you turn it on, and learn how to get back in if you lose your phone.
Know the attacks
Criminals look for ways around a second factor. Learn about MFA fatigue and push bombing, and remember that nobody genuine will ever ask you to read out a code. See fake security alerts.
Crypto holders
Exchange accounts deserve your strongest option, and never SMS alone. See securing exchange logins.