This guide sets up two-factor authentication on an online account, adding a second login step that blocks access even when a password is stolen. Two-factor authentication, abbreviated 2FA, requires a second proof of identity beyond the password, usually a time-based code from an authenticator app or a tap on a hardware security key. This article explains the types of second factor and ranks them by strength, helps choose an authenticator app, walks through enabling 2FA and scanning the QR code on a real account, shows how to save backup codes, adds a security key or passkey for the strongest protection, and explains why SMS codes are the weakest option.
Each section names the tools and standards involved, including Google Authenticator, Microsoft Authenticator, Authy, the TOTP standard, FIDO2 security keys, and passkeys. The result is an account protected by two independent factors, with recovery codes saved in case the second factor is lost. Start by understanding what counts as a factor and which factors resist attack best.
Why Two-Factor Authentication Matters
Two-factor authentication matters because a password alone is a single point of failure that phishing, breaches, and reuse can defeat. The reasons below explain why a second factor changes account security.
- A stolen password no longer grants access. An attacker holding the password still cannot pass the second factor without the app, key, or device.
- Credential-stuffing attacks fail. Reused passwords leaked in breaches cannot unlock a 2FA-protected account on their own.
- Phishing protection improves. A security key bound to the real site refuses to authenticate on a fake one, stopping the attack.
- Account recovery stays in the owner control. Backup codes let the account owner regain access without depending on the attacker-facing login.
Google reported that adding an on-device prompt as a second factor blocked all automated bot attacks and the large majority of targeted attacks in its testing. A second factor turns a single barrier into two independent ones.
What Are the Types of Two-Factor Authentication?
Two-factor authentication uses four main second-factor types, ranked from strongest to weakest below. Each type adds a different kind of proof beyond the password.
- Security keys and passkeys are strongest. A FIDO2 hardware key or a passkey uses public-key cryptography bound to the real site, so phishing pages cannot capture it.
- Authenticator app codes rank next. A TOTP app generates a six-digit code that changes every 30 seconds and never travels over a network.
- Push notifications are convenient but phishable. An approval prompt is strong unless the user approves a fraudulent request, which attackers exploit with prompt bombing.
- SMS and email codes are weakest. A code sent by text or email can be intercepted through SIM swapping or a compromised inbox.
TOTP stands for time-based one-time password, the open standard behind authenticator apps. A TOTP code outranks SMS because it never leaves the device and cannot be redirected by a SIM-swap attack.
Choose an Authenticator App
An authenticator app generates time-based codes on the device, making it the most widely supported strong second factor. The apps below are established TOTP authenticators.
- Google Authenticator generates standard TOTP codes. The app supports optional cloud sync tied to a Google account for moving codes to a new phone.
- Microsoft Authenticator adds push approval. The app handles TOTP codes and one-tap approvals for Microsoft accounts, with encrypted cloud backup.
- Authy offers multi-device sync. The app, from Twilio, backs up encrypted tokens and runs on several devices at once.
- Open-source options exist. Apps such as Aegis on Android and Raivo on iOS store TOTP secrets locally for users who prefer no cloud account.
Any TOTP app reads the same QR code, so the choice depends on backup and sync needs. Install the chosen app before enabling 2FA on an account.
Enable 2FA and Scan the QR Code
Enabling 2FA in account settings and scanning the QR code links the authenticator app to the account. The steps below apply to most services with minor wording differences.
- Sign in to the account and open Settings, then Security or Account.
- Find the option labeled Two-Factor Authentication, Two-Step Verification, or 2FA, and select Authenticator app.
- Open the authenticator app and choose Add account or the plus icon.
- Point the phone camera at the QR code shown on screen to import the secret automatically.
- Type the six-digit code the app displays back into the website to confirm the link.
- Save the change, which switches the account to require the code at each new sign-in.
A service that shows a text setup key instead of a QR code lets the secret be typed into the app manually. The next code refreshes every 30 seconds.
Save Backup Codes
Backup codes are one-time recovery codes that restore account access when the authenticator device is lost or replaced. The steps below store them safely.
- Open the 2FA setup page and select Get backup codes or View recovery codes.
- Copy the full set of one-time codes the service displays.
- Save the codes in a password manager secure note or print them and store the paper offline.
- Avoid storing backup codes in the same place as the password, since one breach would expose both.
- Regenerate a new set if any code is used or the list is exposed, which invalidates the old codes.
Each backup code works once. A saved set lets the account owner sign in if the phone running the authenticator is lost, stolen, or reset.
Add a Security Key or Passkey
A security key or passkey provides phishing-resistant 2FA using public-key cryptography bound to the real website. The steps below register one.
- Obtain a FIDO2 hardware key such as a YubiKey or a Google Titan key, or use a built-in passkey on the phone or laptop.
- Open the account Security settings and select Add security key or Add passkey.
- Insert the hardware key and touch its sensor, or follow the passkey prompt that uses the device fingerprint or face unlock.
- Name the key so multiple registered keys stay identifiable.
- Register a second backup key and store it separately, so a lost key does not lock the account.
A passkey stores the private key in the device secure hardware and syncs through the platform account, such as iCloud Keychain or a Google account. A FIDO2 key and a passkey both refuse to authenticate on a fraudulent domain.
Avoid SMS Codes Where Possible
SMS codes are the weakest second factor because the carrier network can be manipulated. The risks below explain why an authenticator app or key is preferred.
- SIM swapping redirects the code. An attacker who transfers the phone number to a new SIM receives every SMS code.
- SS7 network flaws allow interception. Weaknesses in carrier signaling can route text messages to an attacker.
- Lost signal blocks the code. An area with no cellular service prevents the SMS code from arriving, while a TOTP app works offline.
- SMS is still better than nothing. An account offering only SMS 2FA should enable it, since any second factor beats a password alone.
A SIM-swap attack moves the victim phone number to an attacker SIM, after which SMS codes arrive on the attacker device. An authenticator app generates codes on the original device and is immune to this redirection.
Second-Factor Strength Comparison
| Second Factor | Phishing Resistance | Works Offline | Main Weakness |
|---|---|---|---|
| Security key (FIDO2) | Highest | Yes | Requires carrying the hardware key |
| Passkey | Highest | Yes | Tied to a platform account for sync |
| Authenticator app (TOTP) | Moderate | Yes | Codes can be entered on a phishing page |
| Push notification | Moderate | No | User can approve a fraudulent prompt |
| SMS code | Low | No | SIM swapping and network interception |
| Email code | Low | No | A compromised inbox exposes the code |
Common Mistakes to Avoid
Several errors weaken two-factor authentication or risk a lockout. The mistakes below recur when people enable 2FA.
- Skipping backup codes. A lost phone with no saved codes can lock the account permanently.
- Storing codes with the password. Keeping backup codes beside the password lets one breach defeat both factors.
- Relying only on SMS. SMS exposes the account to SIM swapping; an authenticator app or key avoids it.
- Registering only one security key. A single key with no backup means a lost key blocks access.
- Reusing a weak password. 2FA protects a second barrier, so the password still needs to be a strong, unique created password.
Key Takeaways
- Prefer an authenticator app over SMS. TOTP codes never travel over a network and resist SIM swapping.
- Use a security key or passkey for key accounts. FIDO2 keys and passkeys resist phishing entirely.
- Save backup codes separately. Recovery codes restore access when the second-factor device is lost.
- Register a backup security key. A second key prevents a lockout if the first is lost.
- Pair 2FA with a strong password. Two factors protect two barriers, and both need to hold.
What is two-factor authentication?
Two-factor authentication is a login method that requires a second proof of identity beyond the password, such as a code from an authenticator app or a tap on a security key. It blocks access even when the password is stolen.
Which 2FA method is most secure?
A FIDO2 security key or a passkey is most secure. Both use public-key cryptography bound to the real site, so phishing pages cannot capture them. An authenticator app ranks next, ahead of push, SMS, and email.
Is SMS two-factor authentication safe?
SMS is the weakest second factor because SIM swapping and network flaws can redirect codes. SMS still beats no second factor, but an authenticator app or security key is safer and works offline.
What happens if I lose my authenticator phone?
Use a saved backup code to sign in, then register the authenticator on a new device. Without backup codes or a second registered key, account recovery depends on the service provider and may take time.
What is the difference between a passkey and an authenticator app?
A passkey stores a private cryptographic key in device hardware and resists phishing entirely. An authenticator app generates a typed six-digit code that a phishing page can capture if the user enters it on a fake site.
Do I still need a strong password with 2FA enabled?
Yes. Two-factor authentication protects a second barrier, but the password remains the first. A strong, unique password and a second factor together provide the full protection of two independent factors.
Last Thoughts on Two-Factor Authentication
Two-factor authentication turns a single password barrier into two independent ones, blocking access even after a password leak. An authenticator app generating TOTP codes outranks SMS, and a FIDO2 security key or passkey resists phishing entirely. Saving backup codes and registering a second key prevent a lockout when a device is lost.
Because the password remains the first factor, 2FA works best alongside a strong, unique password stored in a password manager, which can hold both the password and the TOTP codes. The role of a second factor within wider account defense appears in the overview of computer security basics.
