Two-factor authentication, explained
What two-factor authentication is, why it matters so much, and which type to use for the best protection.
Two-factor authentication — often written as 2FA — is one of the most powerful security tools available to you. Even if someone steals your password, they still cannot get into your account without the second factor.
Quick summary
Two-factor authentication (2FA) adds a second check when you log in. After entering your password, you also need a one-time code from your phone or a physical key. This means a stolen password alone is not enough to break in. Turn it on for every important account — especially email, your website, and anything financial.
What "two factors" means
Security professionals describe authentication factors in three categories:
- Something you know — a password or PIN
- Something you have — your phone, a physical security key
- Something you are — a fingerprint or face scan
Traditional password-only login uses just one factor. Two-factor authentication combines two of these — usually your password plus a code from your phone. Even if an attacker has your password, they don't have your phone.
The types of 2FA, from weakest to strongest
Not all 2FA is equal. Here they are in order from least to most secure:
| Type | How it works | Security level | Notes |
|---|---|---|---|
| SMS text message | A code is texted to your phone | Low–Medium | Vulnerable to SIM-swapping attacks; better than nothing |
| Email code | A code is sent to your email | Low–Medium | Only as secure as your email account |
| Authenticator app | A time-sensitive code generated on your phone | High | Recommended for most accounts |
| Push notification | You approve a pop-up on your phone | High | Convenient; used by Duo, Microsoft Authenticator |
| Hardware security key | A physical USB/NFC key you tap | Very high | Best for highest-risk accounts |
| Passkey | Built into your device; uses Face ID or fingerprint | Very high | The future of login — see Passkeys, explained |
Which type should I use?
For most business owners, an authenticator app is the best balance of security and convenience. It generates a new 6-digit code every 30 seconds, works offline, and is not vulnerable to SIM-swapping attacks.
Popular authenticator apps include:
- Authy — saves your accounts to the cloud so you can recover them if you lose your phone
- Google Authenticator — simple and widely supported
- Microsoft Authenticator — good if you use Microsoft 365
- 1Password — your password manager can also store authenticator codes
See Using an authenticator app for setup instructions.
If you manage very sensitive accounts — financial accounts, domain registrars, high-value email accounts — consider adding a hardware security key (like a YubiKey) as an extra layer.
Which accounts need 2FA most?
Start here:
Your email account. Email is the master key — it's how every other account gets reset. This is the most important one.
Your website's admin login (WordPress, Webflow, Squarespace, etc.).
Your hosting account (Flywheel, WP Engine, Kinsta, etc.).
Your domain registrar (GoDaddy, Namecheap, Cloudflare, etc.).
Financial accounts — banking, Stripe, PayPal.
Social media accounts — especially if you have an audience or run ads.
Your password manager — yes, protect the vault itself.
Why SMS codes are not ideal (but still okay)
You may notice that some accounts only offer SMS 2FA. This is better than no 2FA at all — use it. But be aware that SMS can be intercepted through a technique called SIM swapping, where an attacker convinces your phone carrier to transfer your number to a phone they control.
For most small businesses, this risk is low but real. When an account offers an authenticator app as an option, choose that instead.
What to do if you lose access to your 2FA device
When you set up 2FA, most services give you backup codes — a list of one-time codes you can use if you lose your phone. Save these somewhere safe:
- Print them and store in a locked drawer
- Save them in your password manager's secure notes
- Store a copy with a trusted person if appropriate
If you lose your phone and don't have backup codes, account recovery can be slow and difficult. Set up your backup codes now, before you need them.
Common questions
Related guides
- How to set up two-factor authentication
- Using an authenticator app
- Passkeys, explained
- Why you need a password manager
- Your business security checklist
Need a hand?
Learn more
Choosing a password manager
A plain-English comparison of the most popular password managers to help you pick the right one for your business.
How to set up two-factor authentication
Step-by-step instructions for enabling two-factor authentication on your most important accounts — email, your website, and more.