Two-factor authentication, explained

Two-factor authentication, often written as 2FA, is one of the most powerful security tools available to you. Even if someone steals your password, they still cannot get into your account without the second factor.

What "two factors" means

Security professionals describe authentication factors in three categories:

Something you knowA password or PIN
Something you haveYour phone, a physical security key
Something you areA fingerprint or face scan

Traditional password-only login uses just one factor. Two-factor authentication combines two of these: usually your password plus a code from your phone. Even if an attacker has your password, they don't have your phone.

Any two of the three count, and the second one is the whole point: someone who has stolen your password arrives at the same check you do, holding half of what it asks for.

Read this as text

Security people sort proof of identity into three kinds: something you know (your password), something you have (your phone, or a security key), and something you are (a fingerprint or face scan).

A password-only login asks for one of them. Two-factor authentication asks for two: usually your password plus a code from your phone. Supply both and the login check unlocks your account.

Now follow the attacker. Somebody who has stolen your password arrives at exactly the same check, and it asks the same two questions. They can answer the first one. They do not have your phone, so they cannot answer the second, and the check refuses them, which is why 2FA protects an account whose password is already public.

The types of 2FA, from weakest to strongest

Not all 2FA is equal. Here they are in order from least to most secure:

Type	How it works	Security level	Notes
SMS text message	A code is texted to your phone	Low to Medium	Vulnerable to SIM-swapping attacks; better than nothing
Email code	A code is sent to your email	Low to Medium	Only as secure as your email account
Push notification	You approve a prompt on your phone	Medium to High	Convenient, but plain tap-to-approve can be worn down by flooding you with prompts; prefer the versions that make you type or match a number
Authenticator app	A time-sensitive code generated on your phone	High	Recommended for most accounts
Hardware security key	A physical USB/NFC key you tap	Very high	Best for highest-risk accounts
Passkey	A secret stored on your device, unlocked the way you unlock the device: Face ID, fingerprint or PIN	Very high	The future of login. See Passkeys, explained

Which type should I use?

For most business owners, an authenticator app is the best balance of security and convenience. It generates a new code, usually six digits, every 30 seconds, works offline, and is not vulnerable to SIM-swapping attacks.

Popular authenticator apps include:

AuthyCan store an encrypted backup of your accounts in Authy's cloud, so you can recover them if you lose your phone (you have to switch the backup on)
Google AuthenticatorSimple and widely supported
Microsoft AuthenticatorGood if you use Microsoft 365
1PasswordYour password manager can also store authenticator codes

See Using an authenticator app for setup instructions.

If you manage very sensitive accounts (financial accounts, domain registrars, high-value email accounts), consider adding a hardware security key (like a YubiKey) as an extra layer.

Which accounts need 2FA most?

Start here:

0 of 7 done

Your email account. Email is the master key. It's how every other account gets reset. This is the most important one.
Your website's admin login (WordPress, Webflow, Squarespace, etc.).
Your hosting account (Flywheel, WP Engine, Kinsta, etc.).
Your domain registrar (GoDaddy, Namecheap, Cloudflare, etc.).
Financial accounts: banking, Stripe, PayPal.
Social media accounts: especially if you have an audience or run ads.
Your password manager: yes, protect the vault itself.

Saved in this browser only.

How to set it up

You'll need:

Your phone (to receive or generate codes)
An authenticator app (recommended). See Using an authenticator app
Access to the account you want to secure

Set it up on your email first, then work down the list above.

The general process for any account

Most services follow the same steps:

Find the settingOpen security settings and pick the authenticator app
Connect your appScan the QR code and enter the first code
Save backup codesStore the recovery codes somewhere safe

Stage 1 of 3: Find the setting

Open your account settings. Look for "Security," "Privacy," or "Account." The exact label varies by service.

Find the two-factor or multi-factor authentication option. It may be called "2-Step Verification," "MFA," or "Two-Factor Authentication."

Choose your method. Select "Authenticator app" if available. It is more secure than SMS.

Stage 2 of 3: Connect your app

Scan the QR code. Open your authenticator app, tap the "+" or "Add account" button, and point your phone's camera at the QR code on screen.

Enter the first code. Your app will show a 6-digit code. Type it in to confirm the connection is working.

Stage 3 of 3: Save backup codes

Save your backup codes. The service will give you a set of one-time recovery codes. Save these somewhere safe, in your password manager's secure notes, printed and in a locked drawer, or both.

You're done

2FA is now active. The next time you log in on a new device, you'll be asked for a code from your authenticator app.

Setting up 2FA on specific services

Google 2-Step Verification:

Go to your Google Account at myaccount.google.com.
Open Security & sign-in.
Under "How you sign in to Google," select Turn on 2-Step Verification.
Follow the on-screen steps.
To use an authenticator app, open your 2-Step Verification settings and choose Set up authenticator, then scan the QR code with your app.
Save the backup codes Google provides. Google's are 8-digit codes you can print or download.

If you're a Google Workspace admin, see turning on 2-step verification for your team's settings.

Google also offers passkeys, hardware security keys, Google prompts, and codes by text or call. Google says passkeys and hardware security keys are the ones that protect you from phishing, and it recommends Google prompts over codes if you are not using a passkey. Google also warns that codes sent by text or call can be undermined by attacks on your phone number.

Setting up 2FA on your domain registrar

Your domain registrar is critically important. If someone gains access to your domain registrar, they can redirect your website and email to a server they control. Protect it with 2FA.

Look for security settings in your registrar's account dashboard:

GoDaddy: your account's Security page → under Enhanced Security, switch on the 2-Step Verification toggle. You have to set up at least one verification method first.
Namecheap: Profile → Security, then in the Access section click Manage next to Two-Factor Authentication. Namecheap offers an authentication app (TOTP) or a device/security key, but only one method at a time.
Cloudflare: under the My Profile dropdown select My Profile, then Authentication, then Add next to Mobile App Authentication (or Security Key Authentication).

The steps vary by registrar, but follow the general process above.

Why SMS codes are not ideal (but still okay)

You may notice that some accounts only offer SMS 2FA. This is better than no 2FA at all: use it. But be aware that SMS can be intercepted through a technique called SIM swapping, where an attacker convinces your phone carrier to transfer your number to a phone they control.

For most small businesses, this risk is low but real. When an account offers an authenticator app as an option, choose that instead.

What to do if you lose access to your 2FA device

When you set up 2FA, most services give you backup codes: a list of one-time codes you can use if you lose your phone. Save these somewhere safe:

Print them and store in a locked drawer
Save them in your password manager's secure notes
Store a copy with a trusted person if appropriate

If you lose your phone and don't have backup codes, account recovery can be slow and difficult. Set up your backup codes now, before you need them.

Don't lock yourself out

Before finishing 2FA setup, always save your backup codes. If your phone is lost, stolen, or replaced, backup codes are how you get back in.

If you get locked out of an account after enabling 2FA:

Look for a "Use a backup code" link on the login page.
Check your saved backup codes.
Use the account's account recovery process (usually involves verifying your identity by email or phone).

Common questions

What if I get a 2FA code I didn't ask for?

It usually means someone is trying to log in as you, often because they already have your password. Do not share the code with anyone. Change your password immediately. Someone phishing you may call or text pretending to be a service and ask you to read them the code. Never do this.

Can 2FA be bypassed?

It is much harder to bypass than a password alone. The main attacks are: convincing you to share the code (social engineering), SIM swapping (for SMS codes), and phishing sites that relay codes in real time. Authenticator app codes and hardware keys are resistant to most of these. Passkeys are designed to resist all three: there is no code for anyone to talk you into reading out, nothing arrives by text message, and a passkey only works on the site it was created for.

Is 2FA annoying to use every day?

Most services only ask for your second factor on new devices or after a period of inactivity. Most let you mark a device as trusted, and then only ask for a code when you log in from a device they don't recognize. How long that trust lasts is up to each service, so expect to be asked again from time to time. Once you have the app set up, it is a few extra seconds, and much less annoying than recovering a hacked account.

What if my team uses shared accounts?

For shared accounts, the authenticator app needs to be on a shared device, or you can use a password manager that can also store the one-time code (1Password can act as an authenticator this way). Keep that login in a vault the team shares, so everyone who needs the code can get it.

What happens if I get a new phone?

Set up your authenticator app on the new phone before you reset or sell the old one. How you move your codes across depends on the app; see what to do when you get a new phone. If you've already lost access, use backup codes or the service's account recovery process.

Do I need 2FA if I use a password manager?

Yes. A strong, unique password protects you if a site is breached. 2FA protects you if your password is stolen in other ways: phishing, for example. They solve different problems. Use both.