A password doesn’t have to be the only barrier
Two-factor authentication, or 2FA, combines two different kinds of evidence that you’re allowed to sign in. A common example is a password plus a code from an authenticator app or a security key.
Two passwords aren’t two independent factors. A fingerprint may unlock a device or credential, but its exact role depends on the sign-in system.
How a typical login works
- Enter your username and password on the real service.
- Complete the second-factor check using the method you enrolled.
- Review whether to trust the device, especially on a shared computer.
Choose the method carefully
Authenticator apps and hardware security keys avoid some weaknesses of SMS. Where available, phishing-resistant security keys or passkeys can offer stronger protection against fake login sites. SMS can still be better than a password alone when stronger options aren’t supported.
No method makes an account impossible to compromise. Phishing, stolen sessions, weak recovery processes, and an already compromised device can bypass or undermine protection.
Plan for a lost phone
Save recovery codes securely and enroll an appropriate backup method. Understand the provider’s recovery process before you need it. An authenticator often works without mobile reception, while receiving an SMS depends on the phone service.
Turn it on
Open the real service’s security settings, find two-factor authentication or two-step verification, and follow its setup instructions. Test the method and preserve the recovery information.
Start with your primary email account, password manager, and other important accounts. Never give a caller or message sender a login code, and never approve a prompt for a sign-in you didn’t initiate.
