Two-factor authentication: why a second step matters

Updated: Oct 28, 2026

Passwords fail in predictable ways: they are guessed, reused across sites, leaked in breaches and typed into convincing fake login pages. Two-factor authentication (2FA) adds a second, independent proof of identity so that a stolen password alone is not enough. Not all second factors are equal, though. Some stop nearly every attack; some stop only the laziest. This article explains the main types, how they differ, and how to set them up without locking yourself out.

What the second factor actually checks

Authentication factors fall into three categories: something you know (a password or PIN), something you have (a phone, a hardware key), and something you are (a fingerprint or face). Two-factor authentication requires proofs from two different categories. A password plus a security question is not 2FA, because both are things you know and both leak the same way. A password plus a code from your phone is, because an attacker with the password still needs the device.

The common second factors:

• SMS codes. The service texts a one-time code. Convenient, but the weakest option: SIM-swap attacks convince a carrier to move your number to an attacker’s SIM, SS7 network flaws allow interception, and phishing pages relay the code in real time.
• Authenticator apps (TOTP). At setup the service shows a QR code containing a secret; the app (Google Authenticator, Aegis, Authy, a password manager) derives a six-digit code from the secret and the current time, rotating every 30 seconds. Nothing travels over the mobile network, so SIM swaps are useless. Still vulnerable to real-time phishing, since the code can be typed into a fake page and relayed within its 30-second window.
• Push approval. The service sends a prompt to a registered app and you tap Approve. Convenient, but “prompt bombing”, sending prompts until a tired user taps yes, has succeeded against real organisations. Number matching, where you type a number shown on the login screen into the app, mitigates it.
• Hardware security keys and passkeys (FIDO2/WebAuthn). A key such as a YubiKey, or a passkey stored on your phone or computer, signs a challenge that includes the website’s origin. A fake site has a different origin, so the signature is useless to it; phishing is defeated by design. Nothing to type, nothing to relay. This is the strongest widely available option.
• Backup codes. A set of single-use codes generated at setup, meant to be printed and stored offline for when the primary factor is lost.

Which to choose

For anything important, email, password manager, banking, primary social accounts, domain registrar, cloud console, use a phishing-resistant method: a hardware key or a passkey, with a second key or passkey enrolled as backup. Where that is unavailable, use an authenticator app. Use SMS only where nothing else is offered, and then still enable it, because it is far better than a password alone. Email is the account to protect most carefully: password resets for everything else flow through it.

Setting up without locking yourself out

1. Before enabling 2FA, decide where backup codes will live: a password manager’s secure notes, a printed sheet in a safe, or both.
2. Enrol two second factors where possible: two hardware keys, or a key plus an authenticator app. A single phone that is lost, stolen or broken is the most common lockout cause.
3. If using an authenticator app, choose one with encrypted backup or export, so a new phone can be restored. Or store the TOTP secrets in a password manager that syncs.
4. Save the backup codes the service generates. Test one if the service allows it.
5. Review the account’s recovery options: remove old phone numbers and recovery emails you no longer control.
6. Repeat for each account, starting with email and the password manager.

Turning on 2FA and keeping recovery codes

• Enable 2FA everywhere it is offered; any form beats none.
• Prefer hardware keys or passkeys, then authenticator apps, then SMS.
• Always enrol a second factor of the same or another type as backup.
• Store backup codes offline and know where they are.
• Never approve a push prompt you did not initiate; treat unexpected prompts as an attack in progress and change the password.
• Never type a 2FA code into a page you reached from a link in a message. Go to the site directly.

Frequently asked questions

What if I lose my phone?

Use a backup code, your second enrolled key, or the authenticator app’s cloud backup on the new phone. If you have none of these, you depend on the service’s account recovery process, which can take days and may fail. This is why backups are set up before they are needed.

Are passkeys the same as 2FA?

A passkey combines possession of the device with the device’s own unlock (PIN or biometric), so a single passkey login already involves two factors and is phishing-resistant. Many services accept a passkey in place of password plus code.

Is 2FA worth the inconvenience?

Most services remember trusted devices, so the second factor is asked for rarely. Compared with recovering a hijacked email account, the inconvenience is negligible.

A second factor turns a leaked password from a disaster into a warning.

In short: Two-factor authentication requires proof from two independent categories, so a stolen password alone fails. Hardware keys and passkeys resist phishing; authenticator apps resist SIM swaps; SMS resists only password reuse. Enrol backups before you need them, protect email first, and never approve or type a code for a login you did not start.