What Is Two-Factor Authentication, and Why Everyone Keeps Asking You to Turn It On

Two-factor authentication — often shortened to "2FA" — means proving it's really you in two different ways instead of just one. The first way is almost always your password. The second is something extra: a code texted to your phone, a code from an app, or a tap on a notification. Both steps have to check out before you get into your account.

Why one password often isn't enough anymore

Passwords leak. Not because you did anything wrong, but because companies get hacked, and lists of usernames and passwords end up traded and sold. If a criminal has your password from one of those leaks, a password alone would let them straight into your account. Two-factor authentication adds a second lock that a stolen password alone can't open.

What it actually looks like when you log in

You'll type your password as usual. Then you'll be asked for a six-digit code, sent by text message or shown in an authenticator app, or you'll get a notification on your phone asking "Was this you?" that you simply tap to approve. It typically adds about ten seconds to logging in — only when you're on a new device, not every single time.

Which accounts matter most

• Email first — it's often the account used to reset every other password, making it the most valuable one to protect.
• Banking and financial accounts.
• Any account with your payment information saved, like shopping or subscription accounts.
• Social media, especially if you'd be embarrassed or worried about someone posting as you.

What if I lose my phone?

Most services let you set up a backup option when you turn on two-factor authentication — a backup code you print or write down, or a second device. We'll make sure you have a backup option in place before you ever need it.