What is two-factor authentication, and do I need it?

Two-factor authentication (2FA), sometimes called two-step verification, means an account requires two different kinds of proof to log in: something you know (your password) plus something you have (a code from your phone, a tap on an app, or a physical security key). The point is simple and powerful: even if a criminal steals or guesses your password, in a data breach, a phishing email, or a reused-password leak, they still cannot get in without that second factor sitting in your pocket. It is the single most effective step most people can take to protect their accounts, and security experts are close to unanimous that it belongs on your email, banking, and any account you would hate to lose.

Not all second factors are equal. Text-message codes are the most common and far better than nothing, but they are the weakest form, because determined attackers can hijack your phone number through SIM-swapping. Stronger options are an authenticator app (like the ones from Google, Microsoft, or Authy) that generates rotating codes on your device, or best of all a physical security key or your phone's built-in passkey, which are essentially phishing-proof. The newest evolution, passkeys, aims to replace passwords entirely with a cryptographic key tied to your device and unlocked by your face or fingerprint. Start by enabling 2FA on your primary email, since that inbox is the master key attackers use to reset every other account you own.