- Any two-step verification is better than none.
- Authenticator apps and security keys are stronger than text messages.
- Save your backup codes somewhere safe, so a lost phone does not lock you out.
The short answer
A password alone can be stolen, guessed or leaked. Two-step verification adds a second proof that you are really you, such as a code from your phone. Different methods offer different levels of protection. This guide compares them and helps you choose. For a broader introduction, read password manager and two-factor login.
The main methods
| Method | How it works | Strengths | Weaknesses |
|---|---|---|---|
| SMS code | A code arrives by text message | Easy, and works on any phone | Can be intercepted, or stolen through SIM swap fraud |
| Authenticator app | An app on your phone generates a code that changes every 30 seconds or so | Works without a network signal and is harder to steal | You need to move the app if you change phones |
| Push approval | You tap “yes” on a notification | Quick and simple | Attackers can spam requests hoping you tap by mistake |
| Security key | A small physical device that you plug in or tap | Very strong against phishing | Costs money and can be lost |
| Passkey | A cryptographic login stored on your device and unlocked with your fingerprint, face or PIN | Resistant to phishing and easy to use | Not supported everywhere yet. See passkeys. |
Which should you use?
- Best: a passkey or a security key, where the service supports them.
- Good: an authenticator app.
- Better than nothing: SMS codes, if that is the only option.
- Use the strongest method for the most important accounts: email, banking, social media and your music distributor.
Why your email deserves the best protection
Most services let you reset a password by email. If someone takes over your email, they can reach many of your other accounts. Protect your email first, and make sure its recovery options are up to date. Read phishing and SIM swap fraud to understand why phone numbers are a weak point.
How to set it up
- Open the security settings of the account and find two-step verification or multi-factor authentication.
- Choose an authenticator app or a security key if offered.
- Scan the QR code with your app, or follow the instructions to register the key. Be careful with QR codes from other sources. See QR codes.
- Enter the first code to confirm.
- Save the backup codes in a safe place, such as a password manager or a printed copy kept somewhere secure.
- Add a second method, such as a spare key, in case the first one is lost.
Avoid getting locked out
- Keep backup codes safe and separate from your phone.
- Register more than one device where possible.
- Before you replace or reset a phone, move your authenticator accounts first.
- Keep your phone number and recovery email up to date.
- Know how each service handles account recovery.
Scams that target two-step codes
- Never read a code to someone who calls or messages you. A real company will not ask for it.
- Be suspicious of messages that say “approve this login” when you are not logging in.
- If you receive codes you did not request, change your password immediately.
- Read phishing emails and SMS scams for common tricks.
Quick checklist
- Turn on two-step verification for email and banking first
- Prefer passkeys, security keys or authenticator apps
- Save backup codes safely
- Add a second method
- Never share codes
- Review settings every few months
Key points to remember
Two-step verification is one of the most effective protections you can add, and it takes only a few minutes. Start with your email, then move on to your other accounts.
