What is two-factor authentication (2FA)?

Two-factor authentication requires two separate proofs of identity before an account grants access. Typically you start with a password and add a second factor — something you have (a phone or a security key) or something you are (a fingerprint). That extra step makes it significantly harder for an attacker who stole your password to sign in.

How two-factor authentication works

Authentication factors fall into three broad categories: knowledge (a password or PIN), possession (a phone or hardware token), and inherence (biometrics such as fingerprints). When an account uses 2FA it demands a combination from at least two categories. For most consumer and small business accounts, the usual combination is a password plus a possession factor.

Mechanically, the second factor can be: a one-time code generated by an app, a code delivered over SMS, a push notification you approve, or a cryptographic response from a hardware security key. The service verifies both factors before allowing access.

Common 2FA methods and what they do

Authenticator apps

Apps such as time-based one-time password (TOTP) generators produce short codes that change every 30 seconds. You pair the app with an account using a QR code or secret key stored in the app, and the app generates codes locally without network access. For guidance about picking one, see Choose an authenticator app.

SMS verification

Services can send a text message with a code to your phone. SMS is convenient but has known weaknesses: text messages can be intercepted, SIMs can be swapped, and SMS lacks cryptographic protections. Use SMS when nothing stronger is available, and avoid relying on SMS for high-value accounts if stronger options exist.

Hardware security keys

Physical security keys implement public-key cryptography and respond to a site challenge only when you insert or tap the key. They are resistant to phishing and remote account takeover. For a deeper look, see Using hardware security keys.

How to choose a 2FA method

Selection depends on threat level, convenience, and recoverability. Below is a short decision checklist to help you pick a method for personal or small business use.

Threat tolerance: If an account is critical (banking, email, domain registrar), prefer hardware keys or authenticator apps over SMS.
Usability: If team members travel or don’t have smartphones, choose alternatives such as hardware tokens or backup codes.
Recovery and administration: Businesses should use centrally managed methods that include recovery options and device enrollment controls.
Cost: Hardware keys add one-time cost but reduce long-term risk and support overhead.

Small business operators should also consider organizational controls and policies; for more on protecting business accounts, read Protecting business accounts with MFA.

Step-by-step: setting up two-factor authentication

The steps below describe a typical setup flow you will see on most services. Replace service-specific names where necessary.

Sign in to the account and open the security or account settings page labeled two-factor authentication, two-step verification, or multi-factor authentication.
Choose the second-factor method you want to enroll (authenticator app, SMS, hardware key, or backup codes).
If using an authenticator app: install the app on your phone, scan the QR code shown by the service, then enter the one-time code to confirm pairing.
If using SMS: enter the phone number and type the code you receive to confirm the number.
If using a hardware key: follow the prompts to register the key — typically insert or tap the key and allow it to create a connection.
Save any backup or recovery codes presented. Store them offline (printed or in a company password manager) in case you lose access to your second factor.
Test sign-in from another browser or device to confirm the method works.

Worked example: installing an authenticator app

To illustrate, a common flow is:

Install a TOTP app on your phone.
On the service's security page, select 'use authenticator app' and display the QR code.
In the app, choose to add an account and scan the code.
Enter the 6-digit code the app shows into the service to verify pairing.
Download or record backup codes the service gives, and store them where you can retrieve them if you lose the phone.

Recovering access when you lose a factor

Accounts should provide at least one recovery path. Common recovery options are backup codes, alternate phone numbers or email, an admin-managed recovery flow for business accounts, or a physical backup security key.

Keep backup codes in a secure place and treat them like passwords.
Enroll more than one second factor when possible — for example, register both an app and a security key.
For business accounts, set up delegated recovery or a secure admin recovery process so staff can regain access without undermining security.

If all enrolled factors are lost, follow the service's account recovery process. Expect identity verification steps and plan for the time and administrative work needed for recovery.

Common mistakes and how to avoid them

Missteps in deploying 2FA often leave accounts less secure or inaccessible. The following list highlights frequent errors.

Failing to save backup codes. Without them a lost phone can lock you out of critical accounts.
Relying solely on SMS for high-value accounts despite its vulnerabilities.
Not registering an alternate factor or recovery method, especially for administrators in a business.
Using the same recovery phone number across many accounts that could be targeted in a SIM swap.
Failing to document 2FA policies for staff and not testing recovery procedures periodically.

Short comparison: pros and cons at a glance

Authenticator apps - Pros: robust, offline codes; Cons: requires smartphone and backup planning.
SMS verification - Pros: easy to set up; Cons: vulnerable to interception and SIM attacks.
Hardware security keys - Pros: strong phishing resistance; Cons: cost and the need to keep a backup key available.

Closing: practical next steps

Enable two-factor authentication on any account that stores sensitive data or can be used to reset other accounts. For personal use, prioritize authenticator apps or hardware keys when possible. Small businesses should evaluate centralized MFA policies and recovery procedures to reduce operational risk. If you are unsure which option fits your needs, use the checklist above and consult vendor documentation before rolling out changes to multiple users.