Two-factor authentication (often shortened to 2FA) adds a second proof of identity on top of your password. The idea is simple: even if someone discovers your password, without the second element they can't get in. It's one of the measures with the best ratio of effort to protection there is.
Factors are traditionally split into three families: something you know (password, PIN), something you have (phone, physical key) and something you are (fingerprint, face). A good system combines at least two from different families.
The methods compared
| Method | Convenience | Phishing resistance | Notes |
|---|---|---|---|
| Code by SMS | High | Low | Vulnerable to SIM swaps and fake pages |
| Authenticator app (6-digit codes) | High | Medium | Works offline too |
| Push notification to approve | Very high | Medium | Risk of careless approvals |
| Physical security key | Medium | Very high | Must be bought, needs a spare |
| Passkey | Very high | Very high | Not yet supported everywhere |
Code by SMS
This is the most common method because it requires nothing new. Its limit is that the code travels over the phone network and depends on your number: if a fraudster manages to get a duplicate of your SIM issued, they receive your codes. A fake website can also ask for the code and use it in real time. Still, it is far better than no second factor at all.
Authenticator apps
Apps such as those from Google, Microsoft or open-source alternatives generate a code that changes every 30 seconds, calculated on the phone from a secret shared at setup (the standard is called TOTP). It doesn't depend on your phone number and works without a connection. The limit: if you type the code into a fake page quickly enough, the attacker can still use it.
Push notifications
The service sends a notification to your phone and you just tap "Approve". It's extremely convenient, but it carries a specific risk: someone who has your password can send dozens of requests hoping you'll approve one by mistake or out of fatigue. That's why many services now show a number to type in or the location of the request. Golden rule: never approve a request you didn't start yourself. If an unexpected one arrives, it means someone knows your password: change it.
Physical security keys
These are small USB or NFC devices based on the FIDO standards. The key cryptographically checks the site's domain: on a fake page it simply doesn't work. It's the strongest method against phishing. It's wise to buy two and register both, keeping the second somewhere safe as a backup.
Passkeys
These are the most recent development: they replace the password with a pair of cryptographic keys kept on the device and unlocked with a fingerprint or PIN. They offer the same phishing resistance as physical keys, with more convenience.
Which to choose in practice
- For your main email, your Apple or Google account and your password manager: a physical key or a passkey, with an authenticator app as a fallback.
- For banking and payment services: use the system your bank provides, usually a dedicated app, and protect the phone with a strong screen lock.
- For social media and secondary services: an authenticator app is an excellent compromise.
- SMS only where there's no other option.
Recovery codes: don't skip them
When you turn on 2FA, almost every service shows a set of single-use recovery codes. They're for when you lose your phone or key. Print them or write them down and keep them away from the computer, or store them in your password manager. Many people ignore them and discover the problem on the day they change phones.
Changing phones without surprises
Before resetting or giving away your old smartphone:
- check that your authenticator app has an encrypted backup or an export to the new device;
- alternatively, sign in to each service and move 2FA to the new phone;
- make sure your recovery codes are within reach.
Common mistakes
- Turning on 2FA only for social media and not for email, which is the key to recovering everything else.
- Giving a code to someone who phones claiming to be from the bank: no legitimate operator will ask for it.
- Leaving a single sign-in method with no backup at all.
In short
- 2FA makes a stolen password useless in most cases.
- Physical keys and passkeys are the most phishing-resistant methods; SMS is the weakest.
- Never approve sign-in notifications you didn't request.
- Keep your recovery codes and always register a backup method.
- Start with your main email: it's the account that protects all the others.