Two-Factor Authentication: Which Type Should You Use?

Two-factor authentication (2FA) adds a second check after your password. Even if someone steals your password, they still cannot sign in without the second factor. But not all 2FA methods offer the same protection.

SMS text codes

A code is sent to your phone number. This is better than nothing and easy to use, but attackers can sometimes take over a phone number through a SIM swap or intercept messages. Use it only when nothing stronger is offered.

Authenticator apps

Apps generate a new six-digit code every 30 seconds on your device. They do not depend on your phone number and work offline. For most people this is the best balance of security and convenience. Make sure you save the backup codes the service gives you.

Security keys and passkeys

A physical security key or a passkey on your device gives the strongest protection, because it cannot be tricked by a fake website. These are ideal for your email, financial and work accounts.

Where to turn it on first

• Your main email account, since it can reset every other password.
• Banking and payment apps.
• Cloud storage and social media accounts.

Do not lose access

Store backup codes somewhere safe, such as a password manager or a printed copy at home. Never share a verification code with anyone who contacts you, even if they claim to be from support.