Two-Factor Authentication: Types, Setup and Recovery

Published November 8, 2026 · 7 min read · By KeyGuard Pro

Two-factor authentication (2FA) asks for something beyond your password, so a stolen or guessed password alone is not enough to get into your account. It is one of the most effective things you can do for your security, and it takes only a few minutes per account. Here is how the main types compare and how to set them up without risking lockout.

The idea in one sentence

Authentication factors fall into three groups: something you know (a password), something you have (a phone or hardware key), and something you are (a fingerprint or face). 2FA combines two different groups, so an attacker has to defeat both.

The main types, from weakest to strongest

Text message (SMS) codes

A code is sent to your phone number. This is better than nothing and is available almost everywhere, but it has known weaknesses. Attackers can persuade a phone company to move your number to a new SIM card (a "SIM swap"), and messages can sometimes be intercepted or phished. Use it only when nothing better is offered.

Authenticator app codes

An app on your phone generates a six-digit code that changes about every 30 seconds, using a shared secret and the current time (the standard is called TOTP). Codes are produced on your device, so they cannot be intercepted in transit and are not tied to your phone number. This is the sensible default for most people.

Push approvals

Some services send a prompt to your phone that you approve. They are convenient, but attackers sometimes flood a victim with prompts until they tap "approve" by mistake. If you receive a prompt you did not trigger, deny it and change your password.

Hardware security keys

A small physical device, connected by USB or tapped by NFC, performs a cryptographic check that is tied to the real website address. Because the key will not respond to a fake site, it defeats phishing. Keys are the strongest option for email, financial accounts and administrators.

Passkeys

Passkeys replace the password with a cryptographic key stored on your device and unlocked with your fingerprint, face or device PIN. They use the same underlying standard as hardware keys, and they are resistant to phishing by design. Where a site offers passkeys, they are usually a better choice than a password plus a code.

Which accounts to protect first

1. Your main email account. It can reset the password of almost everything else.
2. Your password manager.
3. Banking, payment and shopping accounts.
4. Your phone carrier account, to make a SIM swap harder.
5. Social media and cloud storage accounts that hold personal photos and documents.

How to set it up

1. Open the security or account settings of the service and look for "two-step verification", "multi-factor authentication" or "login security".
2. Choose the strongest method offered. For an authenticator app, scan the QR code with the app, then type the six-digit code to confirm that it works.
3. Save the recovery codes. Most services give you a set of one-time codes. Store them in your password manager or print them and keep them somewhere safe. They are your way back in if you lose your phone.
4. Add a second method if the service allows it, such as a second key or a backup authenticator.
5. Test by signing in from a private browser window.

Avoiding lockouts

The most common 2FA disaster is losing the device that holds the codes. Before you rely on 2FA, make sure that you can recover:

• Keep recovery codes somewhere other than the phone that holds the authenticator.
• Use an authenticator app that supports encrypted backup or can be set up on a second device.
• Register two hardware keys and keep one in a safe place.
• Check that your recovery email address and phone number are current.

Common mistakes

• Turning on 2FA but using the same password everywhere. 2FA helps, but it does not replace unique passwords.
• Typing a code into a page you reached from an email link. Phishing pages can relay codes in real time. Go to the site yourself.
• Sharing codes with anyone who calls you. No legitimate service will ask you to read a code aloud.

The bottom line

Pair a long, unique password from our generator with an authenticator app or security key on every important account. The two together stop the vast majority of account takeovers.