A password proves you know something. The trouble is, "something you know" can leak — through a data breach, a guessed answer, or a convincing phishing page. Two-factor authentication (2FA) adds a second requirement: proof that you also have something, usually your phone. Even if a password leaks, an attacker still can't get in without that second piece.
How it actually works
After you enter your password, the account asks for a second code — sent by SMS, generated by an authenticator app, or confirmed with a tap on a push notification. You approve it, and you're in. It adds a few seconds to logging in, which is the entire reason people skip setting it up, despite it being one of the single most effective account protections available.
Which method to use, in order of preference
Authenticator apps (like Google Authenticator or Microsoft Authenticator) generate a rotating code directly on your phone, without needing a signal or SMS network. This is the most secure common option, because it can't be intercepted the way a text message theoretically can.
Push notifications from the service's own app are nearly as good, and often more convenient — a single tap to approve.
SMS codes are better than nothing, and still worth using if it's the only option a service offers, but they're the weakest of the three — vulnerable to SIM swap fraud, covered in more detail elsewhere on this site.
Where to turn it on first
Not every account needs equal attention immediately. Start with the ones that would cause the most damage if compromised:
- Email — often the recovery route into everything else you own online.
- Banking and financial apps.
- Social media — a compromised account gets used to scam people who trust it's really you.
What to do about backup codes
When you enable 2FA, most services generate one-time backup codes for the scenario where you lose access to your phone. Write these down somewhere safe and offline — not in a screenshot on the same phone. Losing both your phone and your backup codes at once is the one situation where 2FA can genuinely lock you out of your own account.
The honest tradeoff
Yes, it's an extra step. In exchange, it closes off the majority of account takeover attempts, since most rely entirely on a leaked or guessed password being sufficient on its own. Once it's set up, the daily cost is a single tap — and it's the single highest-value five minutes you can spend on your own account security.