Two-Factor Authentication, Explained

The simple idea

Two-factor authentication - you'll see it written as 2FA - means logging in takes two things instead of one.

The first is your password (something you know). The second is a short code from your phone, or a tap on an app (something you have). Even if someone steals your password, they still can't get in without that second thing sitting in your pocket.

Why it matters so much

Passwords get stolen, guessed, and leaked constantly. With 2FA turned on, a stolen password on its own is useless. The attacker would also need your actual phone, which they almost never have.

It's the closest thing to a free upgrade in security. One setting, and the most common way accounts get broken into mostly stops working.

The kinds, from okay to best

• Text message codes. Google or your bank texts you a code to type in. Better than nothing and very common, but text messages can, in rare cases, be intercepted or redirected.
• Authenticator apps. A free app on your phone generates a new code every 30 seconds. More secure than texts, and it works even with no signal. A good default for most people.
• Physical security keys. A small device you tap or plug in. The strongest option, and worth it for your most important accounts if you want to go further.

For most owners, an authenticator app is the sweet spot.

Where to turn it on first

Protect the accounts that would hurt most if someone got in:

• Your email (because password resets for everything else go there)
• Your bank and payment accounts
• Your business tools that hold client data

Your email comes first. Whoever controls your email can reset the passwords to almost everything else.

A practical heads-up

Save your backup codes. When you turn on 2FA, most services give you a set of one-time backup codes. Print them or store them somewhere safe. They're how you get back in if you ever lose your phone.

The bottom line

Two-factor authentication adds a second lock so a stolen password isn't enough to get in. It takes a few minutes to set up and stops the large majority of account break-ins.

Turn it on for your email first, then your money, then your business tools. It's the best security minutes you'll spend all year.