What Is Two-Factor Authentication and Why You Need It
Two-factor authentication (2FA) adds a second layer of security to your accounts beyond your password. It’s the single most effective thing you can do to protect yourself online.
How 2FA Works
Instead of just a password (something you know), 2FA requires a second factor:
- Something you have — your phone, a hardware key, or an authenticator app
- Something you are — your fingerprint or face
Even if someone steals your password, they can’t log in without the second factor.
Types of 2FA
| Type | How It Works | Security Level |
|---|---|---|
| SMS code | Text message with a code | Low (SIM swap attacks) |
| Authenticator app | Time-based code (Google Authenticator, Authy) | High |
| Push notification | Approve login on your phone | High |
| Hardware key | Physical USB/NFC key (YubiKey) | Very high |
| Biometric | Fingerprint or face scan | High |
Why SMS 2FA Isn’t Enough
SMS-based 2FA is better than nothing, but it’s vulnerable to SIM swapping — attackers convince your phone carrier to transfer your number to their SIM card. If possible, use an authenticator app instead.
How to Enable 2FA on Popular Services
Google / Gmail
- Go to myaccount.google.com → Security
- Under “How you sign in to Google,” select “2-Step Verification”
- Follow the prompts to set up an authenticator app
Apple ID
- Go to appleid.apple.com → Sign-In & Security
- Select “Two-Factor Authentication”
- Follow the on-screen instructions
GitHub
- Settings → Password and authentication
- Under “Two-factor authentication,” select “Enable two-factor authentication”
- Choose authenticator app or hardware key
Facebook / Instagram
- Settings → Security and Login
- Scroll to “Two-Factor Authentication” and select “Edit”
- Choose your preferred method
Recommended Authenticator Apps
- Google Authenticator — Simple, free, offline
- Authy — Backs up your codes, multi-device
- Microsoft Authenticator — Good for Microsoft accounts
- 1Password — Password manager with built-in 2FA
What Happens If You Lose Your Phone?
Always save backup codes (provided when you set up 2FA). Store them in a safe place — not on your phone.
Related: Learn how to create strong passwords and protect your privacy online.