Two factor authentication is the most useful security upgrade most people will ever switch on. The idea is simple: even if someone has your password, they cannot get in without a second proof that you actually control the account. That second factor comes in three common forms, and they are not equally strong. Here is a plain-English comparison so you can pick the right multi-factor option for each account that matters.
Why two factor authentication beats a password alone
A password is something you know. A second factor adds something you have. An attacker who lifted your password from a breach has the first but not the second, and stealing the device or token that generates the second factor is a far higher bar than running a leaked list through a script. Almost any second factor beats none — but the three options differ a lot in how they hold up against real attacks. (If your passwords are still reused, start with fixing that first; 2FA is the layer on top.)
SMS codes
The familiar six-digit text. Enter password, get a text, type the number, you are in.
The good. Available almost everywhere, instant setup, works on any phone that receives texts. Where nothing better is offered, SMS still beats nothing.
The bad. SMS was not built for security. It is exposed to SIM-swap attacks, where a scammer talks your carrier into moving your number to their SIM and every code then goes to them. SIM swaps have drained bank accounts and stolen social handles, and they are easy in many countries. Codes can also be phished and replayed within their short window.
Use it when. Nothing better is offered and the account is not money-sensitive. Anything with money attached deserves stronger.
Authenticator apps
An app generates a fresh code every thirty seconds from a secret shared at setup. The code is computed on your device, never transmitted, and rotates on its own. Aegis, Bitwarden, 1Password, Google Authenticator, Microsoft Authenticator all do this.
The good. Codes are local, so a SIM swap does nothing. No network at the moment of login, works offline, and modern apps support encrypted backups so a lost phone is not a permanent lockout. Setup is a one-time QR scan per account.
The bad. Codes can still be phished if you type one into a convincing fake page. And you have to set up backups ahead of time, or losing the phone means recovery codes for every service.
Use it when. You want strong, broadly compatible protection for the dozens of accounts you use. The right default for most people.
Hardware security keys
A small device, often USB-stick sized, that signs a cryptographic challenge from the site you are logging into. Plug in, touch, done. YubiKey and Google Titan are common, and many phones now act as keys through their secure elements.
The good. Essentially phishing-proof. The key checks the requesting site’s domain before responding, so a clone on a lookalike domain gets nothing — even a careful phishing attempt fails at the last step. Nothing to type, nothing to intercept; SIM swaps and network tricks are irrelevant.
The bad. You have to buy one, roughly the price of a nice dinner, and not every service supports them. Losing your only key is a real problem, so the standard advice is to buy two and register both — one in daily carry, one in a drawer.
Use it when. The account is high-value: primary email, cloud storage, crypto, work systems. Anywhere a takeover would do real damage.
Passkeys: the new default
Worth a mention. Passkeys replace both passwords and traditional 2FA on many services. They live in your phone, password manager, or hardware key and authenticate with a touch or biometric, using the same phishing-resistant cryptography as hardware keys. Where offered, enabling them is usually a free upgrade in both security and convenience.
A reasonable setup for a real person
- Primary email, banking, work, password manager: hardware key as primary, authenticator app as backup. Passkeys where supported.
- Social, shopping, streaming, side accounts: authenticator app. Passkeys where supported.
- SMS-only services: use SMS, and lean on the provider to offer better. For very sensitive accounts stuck on SMS, ask whether you still need them.
Common mistakes to avoid
Recovery codes saved only on the same device. Lose or wipe the phone and the codes go with it. Print them or store them in a manager you can reach from a second device.
One phone number across many high-value accounts. That makes a SIM swap catastrophic. Apps and keys sidestep it.
Skipping 2FA on email. Your inbox is the recovery channel for everything else. 2FA on every account except email is a fortress with the back door open — and if it is ever forced, here is what to do in the first 24 hours.
The goal is to stop being the easy target
Most attackers play a numbers game; they are not picking you. They run scripts against millions of accounts and keep whatever does not push back. A unique password plus any two factor authentication moves you out of the easy-target pool. App over SMS moves you further. A hardware key on your important accounts takes you out of the comparison set for most automated attacks entirely. Pick the level that matches the account, set it once, and get on with your life.