$4.00 · 8-page PDF · instant download
Secure checkout by Stripe. Instant download after payment. All sales are final once the guide is downloaded.
Lock your email, bank and social accounts with a second layer of protection
A stolen or guessed password is one of the most common ways accounts are taken over. Two-factor authentication, often called 2FA or two-step verification, adds a second check so a password alone is not enough to get in. This guide walks you through choosing a method, switching it on for your most important accounts and keeping backup codes safe so you never lock yourself out. General information, not professional advice.
Normally, logging in needs one thing: something you know, your password. Two-factor authentication adds a second, different kind of proof. That is usually something you have, such as your phone or a small security key, or something you are, such as your fingerprint or face on a trusted device.
The benefit is simple. If a criminal learns your password from a data breach, a fake login page or a guess, they still cannot get into the account without that second factor. You, meanwhile, only need to complete the extra step occasionally, often just when signing in on a new device.
Different services use different names for the same idea: two-step verification, 2-step, multi-factor authentication (MFA), login approvals or security codes. If you see any of these in a settings menu, it is what this guide is about. Increasingly you will also see passkeys, which replace the password with a device-based login protected by your fingerprint, face or screen lock. Passkeys give similar protection and are worth accepting when offered.
Most services offer several methods. Any 2FA is far better than none, but some methods resist attacks better than others.
| Method | How it works | Strength and trade-offs |
|---|---|---|
| Text message (SMS) code | A code is texted to your phone number. | Easy and widely offered. Weakest option, because numbers can be hijacked through SIM swap fraud or codes can be tricked out of you. |
| Authenticator app | A free app on your phone shows a new six-digit code every 30 seconds. | Strong and works without signal. Needs careful setup when you change phones. |
| Push prompt | Your phone shows a pop-up asking you to approve or deny the login. | Convenient. Only approve prompts you started yourself. |
| Security key | A small USB or NFC device you plug in or tap. | Strongest against fake login pages. Costs money and you should buy two. |
| Passkey | Your device unlocks the account using your fingerprint, face or PIN. | Strong and resistant to fake sites. Support is still growing across services. |
For most people, a good setup is an authenticator app or passkey as the main method, with printed backup codes as the safety net. Common authenticator apps include Google Authenticator, Microsoft Authenticator and others built into password managers. Choose one from your phone's official app store and check the developer name before installing.
Get the rest: the full step-by-step guide plus a printable worksheet for $4.
$4
$4
$4
$4
$4
$4
$4
$4
$4
$4
$4
$4
$4
$4
$4
$4
$4
$4
$4