Two-factor authentication, explained without jargon
Most account settings pages have a section called something like "Two-factor authentication" or "Two-step verification," and a button to turn it on. A lot of people have seen it, ignored it, and moved on. This is what it actually does and why it's worth enabling.
The basic idea
A password is one piece of evidence that you are who you say you are. Two-factor authentication adds a second, independent piece of evidence. The idea is that even if someone gets your password, they still need the second factor to get in.
The three categories of factor are something you know (a password), something you have (a device or token), and something you are (a fingerprint or face). Two-factor authentication combines at least two of these. In practice, for most online accounts, it means a password plus something from your phone.
The three common kinds
SMS codes. After entering your password, the service sends a text message to your phone number with a short code. You enter the code to log in. This is the most widely available form of 2FA, and it's the easiest to set up.
The weakness is that SMS messages can be intercepted or redirected. Phone numbers can be transferred to an attacker's SIM card through a process called SIM swapping, sometimes by convincing a carrier's support staff to make the change. This isn't easy to do, but it has been used against high-profile targets. For most people's accounts, SMS 2FA still meaningfully raises the bar — an attacker can't just use a leaked password and walk in.
Authenticator apps. Apps like Google Authenticator, Authy, or similar tools generate a new six-digit code every thirty seconds. The code is tied to your account setup, not your phone number, so SIM swapping doesn't affect it. You scan a QR code once when setting it up, and after that the app works entirely on your device, without needing a network connection.
This is more secure than SMS and not much harder to use once it's set up. The trade-off is that if you lose access to the app — for instance, if your phone is replaced — you need to use backup codes that the service gave you when you set up 2FA. It's worth storing those somewhere safe.
Hardware keys. A small physical device you plug into a USB port or tap to your phone. You press a button and you're authenticated. These are the most secure option because the key itself never leaves your control and the authentication is tied to the specific site (which defends against even convincing fake login pages).
Hardware keys cost money and require carrying something extra. They're worth considering for accounts where the stakes are highest — primarily email and anything connected to finances.
What to actually do
If you have not turned on 2FA for your email account, that is the highest-priority change you can make. Email is the recovery address for almost every other account; access to it is access to a great deal else.
After email, turn it on for financial accounts, and anywhere else that supports it and where a breach would be damaging.
SMS is fine as a starting point. Authenticator apps are better. If you're going to set up 2FA for the first time, an authenticator app is worth a few extra minutes to configure — most services walk you through it step by step.
The main thing is to turn it on. An account with SMS-based 2FA is meaningfully harder to compromise than one protected only by a password, even accounting for SMS's limitations.