The idea in one paragraph
A password is something you know. If someone else learns it, through a data leak, a fake login page or a lucky guess, they can sign in as you. Two-step login (also called two-factor or multi-factor authentication) adds a second check that uses something different, usually something you have, such as your phone or a small physical key, or something you are, such as a fingerprint. A thief with only your password gets stopped at the second step.
It is not perfect, but it is widely recommended because it turns a single point of failure into two.
Why it helps in practice
Many account problems begin with a stolen or reused password, as described in the article on how account takeovers happen. If a second check is required, the attacker generally needs your phone, your key or your code as well. That makes automated attacks, which try many leaked passwords, far less effective. It also provides an early warning: an unexpected verification prompt or code is a sign that someone has your password and is trying it.
It is especially worth enabling on:
- Your main email account, since it can reset many others.
- Business and brand accounts on social and messaging services.
- Financial accounts.
- Your password manager.
- Any account that holds personal information you would not like exposed.
Common types of second step
Text-message codes. The service sends a short code to your phone number. This is easy to set up and works on almost any phone. The downsides: messages can be delayed or unavailable without signal, and attackers sometimes persuade a phone company to move a number to another SIM, or trick people into reading out the code. It is much better than nothing, but generally considered less robust than other options.
Authenticator apps. An app on your device generates a new short-lived code every few seconds, with no network needed once set up. Codes are tied to the device rather than the phone number, which avoids number-swapping attacks. The trade-off is that losing or replacing your phone can lock you out unless you have backup codes or a transfer method.
Approval prompts. Some services send a notification asking you to approve a sign-in. This is convenient, but people can approve by accident or from fatigue if an attacker triggers repeated prompts. Never approve a prompt you did not initiate.
Security keys. A small physical device you plug in or tap. Many consider this the strongest common option, because it is hard to trick into working on a fake site. The trade-offs are cost, the need to carry it, and the importance of registering a spare in case one is lost.
Biometrics and device passkeys. Fingerprint or face checks on your device, or passkeys that replace passwords with a cryptographic key stored on a device. They can be both convenient and strong. Their availability varies by service, and recovery depends on how your device accounts are protected.
Backup codes. A set of one-time codes that you store safely when you set up two-step login. They are your emergency exit.
Trade-offs to weigh
| Method | Main strength | Main weakness |
|---|---|---|
| Text-message code | Simple, no extra app | Phone-number takeover, signal needs |
| Authenticator app | No dependence on phone number | Device loss can cause lockout |
| Approval prompt | Easy to use | Accidental approvals |
| Security key | Strong against fake sites | Cost, must be kept safe |
| Backup codes | Works when devices fail | Must be stored securely |
There is no universally best option; the right choice depends on the account and the person. A common advice is to use the strongest method a service offers that you will actually keep using, and to avoid leaving an account with none.
Setting it up well
- Start with email, then social and work accounts.
- In the account’s security settings, look for terms like two-step, two-factor or login verification.
- Choose your method, and register more than one if the service allows, such as an authenticator app plus a backup.
- Save backup codes somewhere safe and offline, or in a reputable password manager, but not in the same email account they protect.
- Make sure your recovery email and phone number are current.
- Test it by signing in on another device.
What it does not do
- It will not stop you from being tricked into giving away a code. Phishing messages sometimes ask for the code in real time, and anyone who reads it out hands over access. Genuine staff do not ask for them.
- It does not protect an account if malware controls your device.
- It does not replace strong passwords. Good password habits and a manager still matter.
- It can introduce lockouts if recovery options are poor.
For teams and shared accounts
Shared business accounts raise a practical issue: if codes go to one person’s phone, others cannot sign in when that person is away or leaves. Better arrangements include individual logins with their own second step wherever possible, or an agreed secure method for any unavoidable shared login. These issues are discussed in the guide to shared accounts in a team.
A balanced view
Two-step login adds a small amount of friction in exchange for a large reduction in risk. The friction is usually a few seconds. Plan for losing your phone before it happens, keep recovery details current, and treat unexpected codes as a signal to change your password and check your account.