Two-Factor Authentication Explained: Which Method Should You Use?
This post contains affiliate links. If you buy through them, we may earn a small commission at no extra cost to you.
Two-factor authentication, often called 2FA, asks for something in addition to your password. Even if someone learns your password, they still cannot log in without the second factor.
Text message codes
A code is sent to your phone. This is better than nothing and easy to use, but it is considered weaker than other options because phone numbers can be targeted by scams.
Authenticator apps
An app on your phone generates a short-lived code. These do not depend on your phone signal and are generally a stronger everyday choice.
Security keys
A small physical device you plug in or tap. This is among the strongest methods and helps protect against fake login pages, but you need to keep the key safe and have a backup.
Which should you choose?
- Use an authenticator app or security key when a service offers one
- Use text codes if that is the only option available
- Turn it on first for email, banking and your password manager
Do not lock yourself out
Save the backup codes the service gives you and store them somewhere safe. Update your recovery options if you change your phone number.
Any form of 2FA is a big improvement over a password alone, so enable the best one you will actually use.
Hardware security keys
Some services let you use a physical security key as your second factor. If you want one, check that it supports the connections your devices use (USB-A, USB-C or NFC) and that the accounts you care about accept it. You can browse hardware security keys on Amazon.
