Two-factor authentication

Two-factor authentication (2FA) adds a second check to your password, such as a code from your phone. If someone learns your password, they still need that code. But a second factor brings a new risk, locking yourself out, so this guide also covers recovery.

If you don’t have a password manager yet, start with the guide on passwords.

Kinds of 2FA

SMS

Better than a password alone, but your number can be hijacked by persuading your carrier to issue a new SIM card. If you have a choice, use an authenticator app; if a service only offers SMS, turn that on at least.

Authenticator apps

An authenticator app generates codes that change, usually every 30 seconds, without internet or a mobile signal. This method is often called TOTP.

Some password managers can generate these codes too. That’s convenient, but if an attacker opens the vault, they get both the passwords and the codes. For your main email and other important accounts, keep the codes in a separate app.

A one-time code can also be phished on a fake site. Never give it to anyone who says they’re from support.

Passkeys

Some services let you create a passkey instead of a password. When you sign in, you confirm with a fingerprint, your face or a PIN; the biometrics never leave the device. The passkey is tied to the exact site, so a fake page can’t get it.

Passkeys can sync through a password manager or an Apple, Google or Microsoft account, or live on a single device. Check which kind you have, and how you’d sign in if that device were gone. The account your passkeys sync through needs strong protection too.

Hardware keys

A hardware key, such as a YubiKey, is a separate device that plugs into USB or uses NFC. It works like a passkey and, like one, won’t respond to a fake site. It’s the strongest option for your email and password manager. Register at least two keys and keep the spare somewhere else: a lost key can’t be recovered.

Not losing access

Recovery codes

After you set up 2FA, the service often offers backup codes. Don’t skip this step: a code lets you sign in if you lose your phone. Each code usually works only once.

Print the codes and keep them somewhere safe, or store them in a separate encrypted vault you can reach without your main phone.

The only copy of your password manager’s recovery codes must not be inside that same manager. When the vault is locked, it won’t help you.

If you lose your phone

Imagine your phone is gone. Can you open your password manager on your computer? How will you confirm a sign-in to your email? Where are the backup codes?

Check this in advance. Recovery mustn’t go in a circle: signing in to the manager needs your email, while the email password and second factor are only in the locked manager.

Support can’t always restore access to an encrypted vault if you forget the master password. Read your manager’s recovery rules before you rely on them.

Backups

If you use a local vault, regularly copy the encrypted database to another drive, together with the key file if you have one. Check that the database really opens from the copy. Syncing isn’t a backup: an accidental deletion can spread to every device.

Be careful with exports: CSV and some other formats contain your passwords in plain text. For backups, choose an encrypted format.

Do this today

• Turn on 2FA or a passkey for your main email.
• Turn on 2FA for your password manager, if it offers it.
• Store your recovery codes where you can reach them without your phone or your locked password manager.
• Check that you can sign in from another device.