Two-factor authentication, the most important protection for your accounts

Has my password appeared in a data breach?Check it for free with our Password Checker

Passwords get stolen: in data breaches at big services, through fake login pages or by malware. Our password checker shows whether one of your passwords has already appeared in a data breach. Two-factor authentication (2FA) makes sure that a stolen password alone is not enough to get into your account.

How it works

When you log in, you need two things from different categories:

1. Something you know: your password.
2. Something you have: your phone or a security key.

An attacker who knows your password doesn’t also have your phone in their hand. That stops the vast majority of attacks.

The different second factors

Authenticator app (recommended)

Apps such as Google Authenticator, Microsoft Authenticator, Aegis or the feature built into many password managers generate a new six-digit code every 30 seconds. This works even without an internet connection. For most accounts it is the best choice.

Passkeys and security keys (most secure)

Passkeys replace the password entirely and are tied to your device. You confirm the login with your fingerprint, face recognition or PIN. Hardware keys such as a YubiKey work similarly as a small USB or NFC stick. Both are immune to phishing because they only work on the genuine website.

Confirmation in an app

Some services send a request to their app that you simply approve. That is convenient. Be careful with unexpected requests: never approve a login you did not start yourself. Attackers sometimes keep sending requests until someone approves out of annoyance.

Code by text message (better than nothing)

SMS codes are the weakest second factor. They can be intercepted or redirected via a fraudulently obtained replacement SIM card. Still, they are much better than no second factor at all.

Which accounts first?

Start with the accounts that give access to all the others:

1. Your email account. Whoever controls your inbox can click “Forgot password” on almost any service.
2. Your password manager. It contains all your other logins.
3. Online banking and payment services such as PayPal.
4. Domain provider and hosting. Anyone who gets in here takes over your website and your email addresses.
5. Website login, for example the WordPress admin.
6. Social networks, especially if you use them for business.
7. Cloud storage such as Google Drive, OneDrive or iCloud.

How to set up 2FA

1. Install an authenticator app on your phone or use your password manager’s feature.
2. In the service’s security settings, look for “Two-factor authentication”, “2-Step Verification” or “Two-step login”.
3. Scan the QR code shown with the app.
4. Enter the code from the app to confirm.
5. Save the recovery codes. Almost every service shows you a list of emergency codes once. Print them out or store them in your password manager. They are your way back into the account if you lose your phone.

What if I lose my phone?

With the recovery codes you can get back into your account and set up 2FA on a new device. Many authenticator apps also offer an encrypted backup or can be transferred to a new phone. Set this up right away while you still have both devices.

For businesses: 2FA for everyone

In a company, every account without 2FA is a potential way in. Most services such as Microsoft 365 and Google Workspace let you make 2FA mandatory for all employees. It is one of the most effective security measures there is, and it costs nothing.

You will find further steps in the website security checklist for small businesses.