Two-factor authentication (2FA) is a second step after the password: a code, a confirmation on your phone, or a physical key. Even if the password leaks, nobody gets in without the second factor. But the methods are not equal. An SMS code can be intercepted by SIM swapping and by phishing; a code from an authenticator app resists SIM swapping but not real-time phishing; a hardware key or passkey (FIDO2) cannot be phished by design. The rule: turn on any 2FA today, then move from SMS to an app or a key as soon as you can.

Why a second factor

Passwords leak: databases get breached, people reuse one password across sites, phishing pages collect them by the thousand. A second factor makes a leaked password useless: the attacker also needs something only you have, your phone or your key. Nearly every email and social media takeover happens to accounts without 2FA.

The methods, weakest to strongest

SMS and voice calls. A code arrives at your number. Simple, but the number has two weak points. SIM swapping: the attacker convinces the carrier, or uses leaked personal data, to move your number to their SIM, and all your codes go to them. Phishing: a fake site asks for your password and "the code from the SMS," you type it, they log in. Better than nothing; move on as soon as you can.

Authenticator apps (TOTP). Google Authenticator, Aegis, Microsoft Authenticator, 2FAS, or the generator built into a password manager. The code is computed on the device from a secret and the time; no network needed, and a SIM swap does not help the attacker. The one weakness is real-time phishing: a fake site relays your code to the real one within the same minute. Far stronger than SMS.

Push confirmation. "Is this you? Yes / No" in an app. Convenient, but vulnerable to notification fatigue: an attacker with your password sends requests until you tap Yes by reflex. Good implementations make you match a number shown on the login screen.

Hardware keys and passkeys (FIDO2/WebAuthn). YubiKey and similar devices, or passkeys stored in Apple's or Google's keychain. The key signs a challenge bound to the exact site you are on; a look-alike domain gets no valid signature. Phishing fails by construction. The strongest option for email, the password manager and banking.

What to enable first

  1. Email. Everything else resets through it.
  2. The password manager, if you have one; if not, it is worth getting, see password managers: why and how to choose.
  3. Banking and payment services.
  4. Social media and messengers: in Telegram it is the cloud password under privacy settings; in WhatsApp, two-step verification.
  5. Government services and cloud storage.

Backup codes and recovery

When you enable 2FA, the service gives you backup codes. Store them in the password manager or print them: losing the phone without backup codes means a long exchange with support or a lost account. For TOTP apps, prefer ones with encrypted export (Aegis, 2FAS) so moving to a new phone is not an ordeal. Have two hardware keys: a daily one and a spare in a drawer.

Three mistakes

  • One factor in two roles. 2FA codes stored in the same password manager as the passwords, with the same master password and no 2FA on the manager itself. One breach gets everything. At minimum, protect the manager with a key or a separate app.
  • SMS to the same phone that runs the banking app. A stolen, unlocked phone has both the password and the code. Screen lock and a short timeout are mandatory.
  • Ignoring requests you did not expect. A "confirm sign-in" push when you are not signing in is someone else with your password. Tap No and change the password.

Where a VPN fits

Not directly: 2FA protects the account, a VPN protects the connection. They combine well: the VPN keeps a shared network from seeing where you log in and from tampering with pages on public Wi-Fi, while 2FA keeps out anyone who got the password anyway. What a VPN does and does not do is in what is a VPN.

In short

  • Turn on 2FA, at least by SMS, today if you have none.
  • Move to an authenticator app; for email and the password manager, to a hardware key or passkey.
  • Save backup codes; keep a spare key.
  • Passwords long and unique, from the password generator.

404 VPN protects the network side of signing in: VLESS or WireGuard, DNS inside the tunnel, a kill switch in case the tunnel drops on a public network. Get started here.