Two-Factor Authentication (2FA): Complete Setup Guide

Two-factor authentication (2FA) is one of the most effective security measures you can enable on your online accounts. Even if an attacker obtains your password, they cannot access your account without the second factor.

What Is Two-Factor Authentication?

2FA requires two different types of evidence to verify your identity. These factors typically fall into three categories: something you know (password), something you have (phone or security key), and something you are (fingerprint or face).

Types of 2FA

TOTP (Time-Based One-Time Passwords)

Authenticator apps like Google Authenticator, Authy, or Microsoft Authenticator generate 6-digit codes that change every 30 seconds. These codes are generated from a shared secret key using the TOTP algorithm.

TOTP is widely supported and provides good security. The codes work even without internet access since they are generated locally on your device.

SMS Codes

A verification code is sent to your phone via text message. While better than no 2FA, SMS codes are vulnerable to SIM swapping attacks where an attacker convinces your carrier to transfer your phone number to their device.

Hardware Security Keys

Physical devices like YubiKey plug into your computer or connect via NFC. They provide the strongest form of 2FA because they are immune to phishing — the key cryptographically verifies the website before responding.

Push Notifications

Some services send a push notification to your phone that you simply approve or deny. This is convenient but can be vulnerable to notification fatigue attacks where an attacker repeatedly sends requests hoping you accidentally approve one.

Where to Enable 2FA

Prioritize enabling 2FA on these accounts:

1. Email — your email is the recovery method for most other accounts
2. Banking and financial services
3. Social media accounts
4. Cloud storage
5. Password manager
6. Work accounts

Backup Codes

Always save your backup codes when setting up 2FA. These one-time codes allow you to access your account if you lose your phone or authenticator app. Store them securely, such as in your password manager or printed in a safe place.