Two-factor authentication and passkeys
The strongest upgrade you can make to any account. 2FA methods ranked from weakest to strongest, how passkeys work, and which accounts to protect first.
What two-factor authentication does
Two-factor authentication (2FA), also called multi-factor authentication (MFA), asks for a second proof of identity after your password. The factors are usually described as:
- Something you know: a password or PIN.
- Something you have: your phone, an authenticator app or a security key.
- Something you are: a fingerprint or face scan, usually used to unlock the "something you have".
With 2FA on, a stolen password alone is not enough to get into your account. Microsoft has reported that MFA blocks well over 99 percent of automated account-compromise attacks.
Methods ranked
| Method | Strength | Notes |
|---|---|---|
| Text message (SMS) codes | Basic | Far better than nothing, but vulnerable to SIM swapping and phishing |
| Email codes | Basic | Only as safe as your email account |
| Push approval ("Is this you? Yes/No") | Medium | Vulnerable to "MFA fatigue" spam unless number matching is used |
| Authenticator app codes (TOTP) | Good | Works offline; still phishable if you type the code into a fake site |
| Passkeys | Excellent | Phishing-resistant, no code to type |
| Hardware security keys (FIDO2) | Excellent | Phishing-resistant, physical device you plug in or tap |
How passkeys work
A passkey replaces your password with a pair of cryptographic keys. The private key stays on your device or in your password manager; the website only stores the public key. When you sign in, your device proves it holds the private key, after you unlock it with your fingerprint, face or PIN.
Why that is better:
- Nothing to steal from the website. A breached server only leaks public keys, which are useless to attackers.
- Cannot be phished. A passkey is bound to the real website's domain. A look-alike site simply cannot request it.
- Nothing to remember or type.
Passkeys are supported by Apple, Google and Microsoft accounts, major password managers and a growing list of services such as Amazon, PayPal, GitHub and many banks. They sync across your devices through your iCloud Keychain, Google Password Manager or your password manager.
Which accounts first
- Your main email (it can reset every other account).
- Your password manager.
- Banking, payment apps and investment accounts.
- Your phone carrier account.
- Apple ID, Google or Microsoft account (they control your devices and backups).
- Social media and messaging apps (WhatsApp two-step verification PIN, for example).
- Shopping sites with saved cards.
Setting it up
- Install an authenticator app (see authenticator apps and security keys) or make sure your phone's password manager supports passkeys.
- In each account's security settings, look for "Two-step verification", "2FA" or "Passkeys".
- Prefer passkey or security key if offered; otherwise choose authenticator app; use SMS only as a last resort.
- Save the backup codes the site gives you in your password manager or print them and store them safely. They are your way back in if you lose your phone.
- Add a second method (for example a second security key or a second device) so one lost device does not lock you out.
Never read out, forward or type a 2FA code because someone asked you to. Legitimate companies never need your code. A request for it means someone is trying to log in as you.
Lost your phone?
Use your backup codes or second method to sign in, then remove the lost device from your account's security settings. If you use an authenticator app with cloud backup (several offer encrypted backup), restore it on the new phone.
