Two-factor authentication, explained

What two-factor authentication is, why it matters so much, and which type to use for the best protection.

Two-factor authentication — often written as 2FA — is one of the most powerful security tools available to you. Even if someone steals your password, they still cannot get into your account without the second factor.

Quick summary

Two-factor authentication (2FA) adds a second check when you log in. After entering your password, you also need a one-time code from your phone or a physical key. This means a stolen password alone is not enough to break in. Turn it on for every important account — especially email, your website, and anything financial.

What "two factors" means

Security professionals describe authentication factors in three categories:

Something you know — a password or PIN
Something you have — your phone, a physical security key
Something you are — a fingerprint or face scan

Traditional password-only login uses just one factor. Two-factor authentication combines two of these — usually your password plus a code from your phone. Even if an attacker has your password, they don't have your phone.

Any two of the three count, and the second one is the whole point: someone who has stolen your password arrives at the same check you do, holding half of what it asks for.

Read this as text

Security people sort proof of identity into three kinds: something you know (your password), something you have (your phone, or a security key), and something you are (a fingerprint or face scan).

A password-only login asks for one of them. Two-factor authentication asks for two — usually your password plus a code from your phone. Supply both and the login check unlocks your account.

Now follow the attacker. Somebody who has stolen your password arrives at exactly the same check, and it asks the same two questions. They can answer the first one. They do not have your phone, so they cannot answer the second, and the check refuses them — which is why 2FA protects an account whose password is already public.

The types of 2FA, from weakest to strongest

Not all 2FA is equal. Here they are in order from least to most secure:

Type	How it works	Security level	Notes
SMS text message	A code is texted to your phone	Low–Medium	Vulnerable to SIM-swapping attacks; better than nothing
Email code	A code is sent to your email	Low–Medium	Only as secure as your email account
Push notification	You approve a prompt on your phone	Medium–High	Convenient, but plain tap-to-approve can be worn down by flooding you with prompts; prefer the versions that make you type or match a number
Authenticator app	A time-sensitive code generated on your phone	High	Recommended for most accounts
Hardware security key	A physical USB/NFC key you tap	Very high	Best for highest-risk accounts
Passkey	A secret stored on your device, unlocked the way you unlock the device — Face ID, fingerprint or PIN	Very high	The future of login — see Passkeys, explained

Which type should I use?

For most business owners, an authenticator app is the best balance of security and convenience. It generates a new code — usually six digits — every 30 seconds, works offline, and is not vulnerable to SIM-swapping attacks.

Popular authenticator apps include:

Authy — can store an encrypted backup of your accounts in Authy's cloud, so you can recover them if you lose your phone (you have to switch the backup on)
Google Authenticator — simple and widely supported
Microsoft Authenticator — good if you use Microsoft 365
1Password — your password manager can also store authenticator codes

See Using an authenticator app for setup instructions.

If you manage very sensitive accounts — financial accounts, domain registrars, high-value email accounts — consider adding a hardware security key (like a YubiKey) as an extra layer.

Which accounts need 2FA most?

Start here:

Your email account. Email is the master key — it's how every other account gets reset. This is the most important one.

Your website's admin login (WordPress, Webflow, Squarespace, etc.).

Your hosting account (Flywheel, WP Engine, Kinsta, etc.).

Your domain registrar (GoDaddy, Namecheap, Cloudflare, etc.).

Financial accounts — banking, Stripe, PayPal.

Social media accounts — especially if you have an audience or run ads.

Your password manager — yes, protect the vault itself.

Why SMS codes are not ideal (but still okay)

You may notice that some accounts only offer SMS 2FA. This is better than no 2FA at all — use it. But be aware that SMS can be intercepted through a technique called SIM swapping, where an attacker convinces your phone carrier to transfer your number to a phone they control.

For most small businesses, this risk is low but real. When an account offers an authenticator app as an option, choose that instead.

What to do if you lose access to your 2FA device

When you set up 2FA, most services give you backup codes — a list of one-time codes you can use if you lose your phone. Save these somewhere safe:

Print them and store in a locked drawer
Save them in your password manager's secure notes
Store a copy with a trusted person if appropriate

If you lose your phone and don't have backup codes, account recovery can be slow and difficult. Set up your backup codes now, before you need them.

Common questions

What if I get a 2FA code I didn't ask for?

It usually means someone is trying to log in as you — often because they already have your password. Do not share the code with anyone. Change your password immediately. Someone phishing you may call or text pretending to be a service and ask you to read them the code — never do this.

Can 2FA be bypassed?

It is much harder to bypass than a password alone. The main attacks are: convincing you to share the code (social engineering), SIM swapping (for SMS codes), and phishing sites that relay codes in real time. Authenticator app codes and hardware keys are resistant to most of these. Passkeys are designed to resist all three: there is no code for anyone to talk you into reading out, nothing arrives by text message, and a passkey only works on the site it was created for.

Is 2FA annoying to use every day?

Most services only ask for your second factor on new devices or after a period of inactivity. Once you have the app set up, it is a few extra seconds — and much less annoying than recovering a hacked account.

Do I need 2FA if I use a password manager?

Yes. A strong, unique password protects you if a site is breached. 2FA protects you if your password is stolen in other ways — phishing, for example. They solve different problems. Use both.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.