Two-factor authentication (2FA) is one of the highest-return security investments available. Even if your password is compromised — through a data breach, phishing, or a weak choice — a second factor prevents an attacker from accessing your account. But not all 2FA is equal, and choosing the wrong type can leave you with false confidence. This guide covers every major 2FA type, the tools that implement them best, and how to set them up on the platforms you actually use.
What Is Two-Factor Authentication?
Authentication proves identity using one or more of:
- Something you know (password, PIN)
- Something you have (phone, hardware key)
- Something you are (biometric)
Two-factor authentication requires two of these categories. A password (something you know) plus a time-based code (something you have) constitutes true 2FA. A password plus a security question is not 2FA — both are “something you know.”
Frequently Asked Questions
Is SMS 2FA safe to use?
SMS 2FA is significantly weaker than alternatives and should be avoided where possible.
The primary attack is SIM swapping — an attacker calls your carrier, impersonates you, and convinces a support agent to transfer your phone number to a new SIM. Once successful, they receive your SMS codes. SIM swap attacks have compromised accounts at Twitter, Coinbase, and major crypto exchanges, often resulting in devastating financial losses.
Additional SMS risks:
- SS7 protocol vulnerabilities allow state-level actors to intercept SMS messages in transit
- SMS is unencrypted between carrier infrastructure and your phone
- Malware on Android can silently forward SMS to an attacker
If a service only offers SMS 2FA, it is better than nothing — but actively request they add TOTP or hardware key support.
What is TOTP and which apps should I use?
TOTP (Time-based One-Time Password) generates a six-digit code that changes every 30 seconds using a shared secret stored in an authenticator app. The code is calculated locally — no internet connection required.
Aegis Authenticator (Android, free, open-source) is the strongest recommendation. Key features:
- Encrypted local vault (AES-256-GCM)
- Biometric unlock with password fallback
- Encrypted backup export to local storage or cloud of your choice
- Import from Google Authenticator, Authy, and others
Authy (iOS/Android) is a popular choice. It supports multi-device sync and encrypted cloud backup. However, it is a closed-source product from Twilio, and its multi-device sync is a potential attack surface — if your Authy account is compromised, so are all your TOTP codes. Authy also previously allowed account recovery via SMS, which reintroduces SIM-swap risk.
Google Authenticator added Google account sync in 2023, which is convenient but stores your TOTP secrets in Google’s cloud — exactly the provider you are often trying to have 2FA protect you against.
Recommendation: Use Aegis on Android. On iOS, use Raivo OTP (open-source) or the built-in iOS Passwords app (which added TOTP support in iOS 17).
How do hardware security keys work?
Hardware keys like the YubiKey 5 series implement the FIDO2/WebAuthn standard. When you log into a site, the browser sends a challenge to the key; the key signs it with a private key that never leaves the device and sends back the signature. Even if someone intercepts the response, it cannot be replayed — each challenge is unique.
YubiKey 5 NFC (~$55) supports:
- FIDO2 / WebAuthn (phishing-resistant)
- FIDO U2F (legacy support)
- TOTP (stored on-device, requires YubiKey Authenticator app)
- PIV smart card
- OpenPGP key storage
YubiKey 5C NFC (~$65) adds USB-C for modern laptops and phones.
YubiKey Bio uses fingerprint authentication to authorize the key itself — useful if you worry about unauthorized physical use of the key.
Hardware keys provide phishing resistance that TOTP does not. A TOTP code can be phished in real-time with a proxy site that forwards your code to the real site. FIDO2 binds the key’s response to the specific origin (domain) of the login request — a fake phishing site cannot extract a valid credential even if you insert your key.
Buy a second key as a backup and register both on all important accounts.
What are passkeys and how do they differ from hardware keys?
Passkeys are the consumer-facing implementation of FIDO2. They store credentials in your device’s secure enclave (or a password manager) rather than a separate hardware token. When you authenticate, your device’s biometric sensor unlocks the passkey and signs the server’s challenge.
Passkeys:
- Are phishing-resistant (tied to the specific domain)
- Replace both username/password AND 2FA in a single gesture
- Sync across devices via Apple iCloud Keychain, Google Password Manager, or 1Password
Passkeys stored in iCloud or Google’s servers mean those providers have a copy (encrypted). For maximum security, a hardware FIDO2 key that stores passkeys locally (YubiKey 5 series supports this for up to 25 discoverable credentials) eliminates cloud sync.
How do I set up 2FA on major platforms?
Google Account:
- Go to myaccount.google.com > Security > How you sign in to Google.
- Select 2-Step Verification.
- Follow the setup for your preferred method (passkey, authenticator app, or hardware key).
- Under “Authenticator app,” click Set up authenticator and scan the QR code with Aegis.
GitHub:
- Go to Settings > Password and authentication > Two-factor authentication.
- Click Enable two-factor authentication.
- Choose Authenticator app and scan the QR code.
- GitHub also supports hardware keys under Security keys.
Twitter / X:
- Settings > Security and account access > Security > Two-factor authentication.
- Note: Twitter/X restricts hardware key 2FA to Premium subscribers. TOTP app support is available to all users.
What are backup codes and how should I store them?
Every major service generates backup codes during 2FA setup — a set of 8–10 single-use codes for account recovery if you lose access to your second factor.
Storage recommendations:
- Print them and store in a physically secure location (safe, locked drawer).
- Encrypted file in a local (not cloud-synced) password manager entry.
- Do not store them in the same cloud account they protect — if your Google account is compromised, backup codes stored in Google Drive are also compromised.
Generate new backup codes if you suspect yours have been exposed or after you use one.
What if I lose my hardware key or phone?
Plan for recovery before you need it. Steps:
- Register two hardware keys or two devices with your TOTP app backup on every important account.
- Store backup codes in a secure offline location.
- For YubiKey users, Yubico’s YubiKey Replacement Program can sometimes assist, but it does not restore credentials — account-level recovery is still required.
- Some services allow SMS as a backup method; consider whether the SIM-swap risk is acceptable as a last-resort recovery option versus being permanently locked out.
The worst time to discover your recovery plan is incomplete is when you have already lost access.
2FA Strength Ranking
From strongest to weakest:
- Hardware FIDO2 key (YubiKey, Titan) — phishing-resistant, no shared secret
- Passkey in hardware security key — same as above
- TOTP app (Aegis, Raivo) — strong, offline, not phishing-resistant
- Passkey in device/cloud — phishing-resistant but tied to platform
- Email 2FA — better than SMS, but your email account is the target
- SMS 2FA — vulnerable to SIM swapping, avoid when alternatives exist
Upgrade the most sensitive accounts first: email, password manager, and financial accounts. These are the accounts an attacker would use to reset everything else.