What is two-factor authentication and should I use it?

The premise of password-only security is increasingly fragile. Passwords are stolen through data breaches at services you use, through phishing attacks that trick you into entering them on fake websites, and through brute-force attacks that try millions of combinations automatically. Two-factor authentication addresses this by requiring something you know and something you have before access is granted.

The most common form sends a six-digit code to your phone via SMS when you log in. You enter your password, then enter the code. Even if someone knows your password, they cannot access your account without also having your phone. A stronger alternative is an authenticator app like Google Authenticator or Authy, which generates time-sensitive codes without requiring a mobile signal and is resistant to SIM-swapping attacks that can intercept SMS codes.

Enable two-factor authentication on every account that offers it, starting with your most critical ones. Your email account is the highest priority because it is the recovery mechanism for every other account you own. Then your domain registrar, your hosting provider, your banking, your social media accounts, and every other platform that contains sensitive information or would cause serious disruption if compromised.

The resistance to enabling two-factor authentication is almost always about the minor inconvenience of the additional step at login. That resistance deserves to be dismissed. The additional time required to enter a code at login is measured in seconds. The consequences of a compromised email or bank account can include weeks of recovery work, lost customer trust, and financial loss.

For teams, two-factor authentication policies should be established before the first employee joins. Most enterprise platforms allow administrators to enforce two-factor authentication for all users in an organization. Where that enforcement is available, use it. A single team member's compromised account can expose every customer record and every file in your business's digital ecosystem.