If you do one thing after reading this, turn on two-factor authentication (2FA) for your email. Email is the master key to your other accounts, because "forgot password" links go there. Protect it and you protect a lot.
But which kind of 2FA should you pick? They aren't all equally strong, and the differences are worth knowing.
What 2FA does
A password is something you know. 2FA adds a second thing, usually something you have, such as your phone. Even if someone steals or guesses your password, they still can't get in without that second piece.
That's why it blocks so many attacks. Passwords leak constantly, and a stolen password alone stops being enough.
SMS codes
A code is texted to your phone and you type it in.
Good: easy, works on any phone, and nobody needs to install anything. For people who currently use nothing, it's a real improvement.
Not so good: text messages can be intercepted in some situations. The bigger risk is SIM swapping, where a criminal persuades your mobile company to move your number to their SIM, and then receives your codes. Texts also don't work without signal, and they're easy to phish: a fake login page can ask for the code and pass it straight along.
Verdict: better than nothing, but use something stronger for important accounts if you can.
Authenticator apps
An app on your phone, such as Google Authenticator, Microsoft Authenticator or similar, shows a code that changes every thirty seconds or so.
Good: codes are generated on your device, so there's no SIM swap risk, and it works without signal. It's free and widely supported.
Not so good: if you lose or reset your phone without a backup, you can be locked out. Some apps back up to the cloud, others don't, so check before you change devices. And it can still be phished, since you can type a code into a fake page.
Verdict: a solid choice for most people and most accounts.
Push approvals
You get a notification asking "Is this you?" and tap approve.
Good: very convenient.
Not so good: attackers sometimes spam approval requests until a tired person taps yes just to make it stop. This is called push fatigue. Better systems ask you to type a number shown on the login screen, which helps.
Verdict: fine if it uses number matching. Never approve a request you didn't start.
Hardware security keys and passkeys
A small physical key you plug in or tap, or a passkey stored on your device, uses cryptography tied to the real website.
Good: the strongest option for most people. Because it checks the website's actual address, it resists phishing. A fake page gets nothing.
Not so good: a physical key costs money and can be lost, so you should register a spare. Not every service supports them yet.
Verdict: the best choice for email, banking, admin accounts and anything that would hurt to lose. See our article on passkeys for more.
So which one?
A reasonable ladder:
- Nothing: worst.
- SMS: better.
- Authenticator app: good.
- Security key or passkey: best.
Use the strongest your service offers, starting with email, banking, social media, cloud storage and anything with admin powers.
Don't forget recovery
Whichever you choose, set up a way back in. Save the backup codes the service gives you and keep them somewhere safe and offline, such as a password manager or printed in a drawer. Add a second method if the service allows it. People get locked out of their own accounts more often than they get hacked, so planning for a lost phone is part of doing 2FA well.
For business owners
Require 2FA for everyone, not just admins. Prefer app-based or key-based methods for staff accounts, and mandate the strongest for anyone with access to money, customer data or systems. And have a clear process for what happens when someone loses their phone, so the helpdesk can verify them properly and doesn't become an easy route for attackers to bypass your protection.
