Two-factor authentication (2FA, or two-factor authentication) adds a second check to logging in, on top of your password. The idea: even if someone steals your password, they still need the second factor to get in.
How it works
You have something you know (your password) and something you have (your phone). When you log in somewhere important, the site sends a code to your phone or an authenticator app, and you type it in. Both must match.
- SMS codes: simplest, and fine for most. A little weaker (SIM-swap attacks), but still far better than nothing.
- Authenticator apps (Google, Microsoft, Apple): generate a code on your phone, no SMS needed. More secure.
- Hardware keys: a physical USB key. The strongest, but cost extra.
Where to turn it on (priority order)
- Email — it's the key to everything else.
- Banking and payment apps.
- Social media and cloud storage (Google, Apple, Microsoft).
- Anything with a password you'd be sad to lose.
Is it a hassle?
One extra step, and you can often approve a login with a tap instead of typing a code. Compared to the cost of a compromised account, it's the best "hassle" in computing.
The single highest-value security habit for a home user: turn on 2FA for your email first, then your banking. It defeats the large majority of account-takeover attacks.