Turn on two-step sign-in - a second lock a stolen password can’t pick
A password can be guessed, leaked in a breach, or phished out of you. Two-step sign-in (you’ll also see “2FA” or “2SV”) adds a second check, so the password alone isn’t enough to get in. Switch it on for the handful of accounts that matter and you’ve shut the most common way people actually get hacked. The key choice is which second step - and it’s not the texted code.
The three kinds, worst to best
A texted code is fine as a last resort - far better than nothing - but a determined attacker can have your number moved to their SIM and catch the text. An authenticator app code lives on your phone and can’t be redirected that way. A passkey or security key is better still and can’t be phished at all (that’s a later step). Aim for the app; use a text only where it’s the only option offered.
Pick one authenticator and use it for everything
Use a dedicated authenticator app from a different company than your password manager, so a single account compromise can’t hand over both your password and your codes. Ente Auth is free, open source and works on every phone and computer; on Android, Aegis is a long-standing favourite. Avoid keeping your codes in the same app as your passwords. Set it up once and it’s the same routine on every account after.
Do the accounts that matter first
You don’t need it on everything at once. Start with your email (if you haven’t already), then your bank, then the shopping and social accounts that hold your card or your name. The setting is almost always under Settings → Security → two-step verification (wording varies). Scan a QR code with your authenticator, type the six-digit code back once to confirm, done.
Save the backup codes - this is the bit people skip
When you switch on two-step, the account gives you a set of backup codes. These are what get you in if you ever lose your phone. Save them in your password manager, or print them and keep them with your passport. Skip this and a lost phone can lock you out of your own account - the one genuine risk of two-step, and it’s entirely avoidable.
Phase out the texts where you can
If an account lets you have both, add the app and then remove the text option, so there’s no weaker door left open. Keep a texted code only on accounts that offer nothing better - there, it’s still well worth having.
“Isn’t this a hassle every time I log in?”
Less than you’d think. Most accounts only ask for the second step on a new device or every so often - your own phone and laptop you can mark as trusted. A few seconds now and then, against someone emptying your account with a password they bought for pennies: an easy trade.
Last checked: 19 October 2026. App names and menu wording drift - tell us if anything here has moved.