Turn On Two-Factor Everywhere
A stolen password should be a dead end. A second factor makes it one. Here's which kind to use, which apps to trust, and how not to lock yourself out.
Passwords leak. Through breaches, phishing pages, malware, a sticky note, a reused login on a forum you forgot existed. Assume one of yours is already out there. Two-factor authentication (2FA) means that's not enough: to get in, an attacker also needs something only you have, like your phone or a physical key.
It's the single highest-return security setting most people never touch. Microsoft has reported that multi-factor authentication blocks over 99.9% of automated account attacks. Credential stuffing, the bulk testing of leaked passwords, stops cold at the second step.
Not all second factors are equal
| Factor | Strength | Why |
|---|---|---|
| Passkey / hardware security key | strongest | Cryptographically tied to the real site. A fake login page gets nothing usable. |
| Authenticator app (TOTP) | strong | Six-digit codes generated on your device, offline. A convincing phishing page can still relay one, so check the URL. |
| Push approval | good | Convenient, but attackers spam requests hoping you tap Approve. Never approve a prompt you didn't trigger. |
| SMS / phone call | weakest | Better than nothing, but a SIM swap hands your codes to someone else. |
Use the strongest option each account offers. Check which sites support what at 2fa.directory.
Authenticator apps
- Aegis — Android. Open source, encrypted vault, no account, clean backups. The pick for Android.
- Ente Auth — iOS, Android, desktop and web. Open source, with optional end-to-end encrypted sync.
- 2FAS — iOS and Android, free, with a browser extension for filling codes on desktop.
- Bitwarden Authenticator — iOS and Android, from the password manager team.
- Google Authenticator (iOS) / Android and Microsoft Authenticator — widely used; check their cloud-backup settings so you know where your codes live.
On desktop, the Authenticator extension (Chrome, Firefox, Edge) generates codes in the browser. Password managers like Proton Pass, Bitwarden (paid tier) and KeePassXC can store codes too. That's convenient, but it puts both factors in one vault, so protect that vault with its own strong second factor.
Hardware keys and passkeys
A security key is a small USB or NFC device you tap to log in. It can't be phished, copied over the network or drained by malware. Options include YubiKey, Nitrokey (open-source firmware) and Google Titan. Buy two: register both, keep one somewhere safe.
Passkeys bring the same phishing-proof cryptography to your phone or password manager, often replacing the password entirely. Wherever a site offers one, take it. passkeys.dev explains how they work.
Don't lock yourself out
The second factor protects you only as long as you still have it.
- Save recovery codes for every account, on paper or in your password manager, when you turn 2FA on.
- Back up your authenticator (encrypted export or sync) before you replace or wipe your phone.
- Register a second method where possible: a spare key, or a second device.
Where to start
Turn it on in this order: email first (it resets everything else), then your password manager, bank and payment apps, phone carrier, cloud storage and social accounts. Ten minutes per account, once.
A password is something you know, and secrets leak. A second factor is something you hold. Make the thief need both.