Two-Step Verification: What It Is and Why You Should Use It
A second check that keeps your accounts safe even when a password leaks.
Passwords get guessed, reused and stolen. Two-step verification, also called two-factor authentication or 2FA, adds a second check, so a stolen password alone is not enough to get into your account.
How it works
You sign in with your password as usual. Then the service asks for something else that only you should have, such as a code from an app on your phone, a prompt you approve, or a small physical security key. Only when both checks pass are you let in.
The common types
Codes sent by text message are the most familiar, and they are better than nothing. Authenticator apps generate a new code every thirty seconds on your phone and are generally safer than text messages, because codes cannot be intercepted on the phone network. Approval prompts in an app are convenient. Hardware security keys are the strongest option and are very hard to phish.
Why it matters
Many people reuse a password across several sites. When one site is breached, criminals try the same combination elsewhere. With two-step verification turned on, that attempt fails at the second step, because they do not have your phone or key.
Where to turn it on first
Start with the accounts that would hurt most to lose: your main email, because it can reset every other password, then banking, social media, cloud storage and any work accounts. Look for 'Security' or 'Sign-in' in the account settings.
Keep your backup codes
Most services give you a set of backup codes when you enable two-step verification. Store them somewhere safe and separate from your phone, such as a printed copy in a drawer or a password manager. If you lose your phone, those codes can save you from being locked out.
A note on getting locked out
If you change phones, move your authenticator app before you wipe the old one. Many apps have a transfer feature. Check that the new phone generates working codes before you reset anything.
Two-step verification adds a few seconds to each sign-in. In exchange it removes one of the easiest ways for someone to take over your account, which makes it one of the best security habits you can build.