Two-factor authentication

2026-10-31T00:00:00+00:00

Two-factor authentication (2FA) adds a second check to your password, such as a code from your phone. If someone learns your password, they still need that code. But a second factor brings a new risk, locking yourself out, so this guide also covers recovery.

If you don’t have a password manager yet, start with the guide on passwords.

Kinds of 2FA

SMS

Better than a password alone, but your number can be hijacked by persuading your carrier to issue a new SIM card. If you have a choice, use an authenticator app; if a service only offers SMS, turn that on at least.

Authenticator apps

An authenticator app generates codes that change, usually every 30 seconds, without internet or a mobile signal. This method is often called TOTP.

Some password managers can generate these codes too. That’s convenient, but if an attacker opens the vault, they get both the passwords and the codes. For your main email and other important accounts, keep the codes in a separate app.

A one-time code can also be phished on a fake site. Never give it to anyone who says they’re from support.

Passkeys

Some services let you create a passkey instead of a password. When you sign in, you confirm with a fingerprint, your face or a PIN; the biometrics never leave the device. The passkey is tied to the exact site, so a fake page can’t get it.

Passkeys can sync through a password manager or an Apple, Google or Microsoft account, or live on a single device. Check which kind you have, and how you’d sign in if that device were gone. The account your passkeys sync through needs strong protection too.

Hardware keys

A hardware key, such as a YubiKey, is a separate device that plugs into USB or uses NFC. It works like a passkey and, like one, won’t respond to a fake site. It’s the strongest option for your email and password manager. Register at least two keys and keep the spare somewhere else: a lost key can’t be recovered.

Not losing access

Recovery codes

After you set up 2FA, the service often offers backup codes. Don’t skip this step: a code lets you sign in if you lose your phone. Each code usually works only once.

Print the codes and keep them somewhere safe, or store them in a separate encrypted vault you can reach without your main phone.

The only copy of your password manager’s recovery codes must not be inside that same manager. When the vault is locked, it won’t help you.

If you lose your phone

Imagine your phone is gone. Can you open your password manager on your computer? How will you confirm a sign-in to your email? Where are the backup codes?

Check this in advance. Recovery mustn’t go in a circle: signing in to the manager needs your email, while the email password and second factor are only in the locked manager.

Support can’t always restore access to an encrypted vault if you forget the master password. Read your manager’s recovery rules before you rely on them.

Backups

If you use a local vault, regularly copy the encrypted database to another drive, together with the key file if you have one. Check that the database really opens from the copy. Syncing isn’t a backup: an accidental deletion can spread to every device.

Be careful with exports: CSV and some other formats contain your passwords in plain text. For backups, choose an encrypted format.

Do this today

Turn on 2FA or a passkey for your main email.
Turn on 2FA for your password manager, if it offers it.
Store your recovery codes where you can reach them without your phone or your locked password manager.
Check that you can sign in from another device.

Passwords

2026-10-31T00:00:00+00:00

Passwords are like keys to your digital home. If every door opens with the same key, and that key is easy to copy, you’re in trouble.

The most common mistakes:

one password for several services;
simple passwords that are “easy to remember”^[1], or passwords built from your name, birthday or username;
passwords kept in an unencrypted file.

How passwords get stolen

Data breaches

Services get breached, and the stolen passwords are tried, together with the email addresses, on other sites. That’s how the password to a forum you forgot about years ago can open your email, and your email can open everything else. So every service needs its own password, not the same one with the site’s name added on.

Phishing

An email about your “account being suspended” can lead to a fake sign-in page, and no password is long enough to protect you there. A password manager helps you notice the fake: it won’t offer your password on someone else’s domain. If autofill unexpectedly does nothing, check the address. Open important services from bookmarks, not from links in messages.

Guessing

Attackers don’t try every combination of characters. They try common passwords, dictionaries and earlier leaks, along with substitutions like @ for a and a birth year at the end. Once they have stolen password hashes, they test guesses on their own hardware with no limit on attempts. Only length and randomness help against that.

Malware

Malware can record keystrokes, steal browser data, or take over a session that’s already signed in. A password manager won’t protect you from this: keep your system updated and be careful with programs and browser extensions.

Strong passwords

Random passwords

Generate a separate random password for each service, at least 15 characters long, and longer if the service allows. For example: Vq9!sL7@pT2#xN8zR4$k. Capitals, digits and symbols alone don’t make a password strong: Password123! is still a bad one.

If a service strictly limits password length (some banking apps do), use a random password of the maximum allowed length: per character, it gives more strength than a passphrase.

Passphrases

Passphrases are easier to remember and to type by hand, but they need more characters than a random password of the same strength.

The reliable way is to generate six or more random words in your password manager, for example: turmeric-kindling-polyester-taps-parasitic-orbit. To remember the words, tie them to images in your head, without changing the phrase itself.

A random digit or symbol in a random place in the phrase makes it much harder to guess.

If you make up a phrase yourself, avoid quotes, song lyrics, common sayings and facts about yourself: they’re easy to add to a cracking dictionary. Length alone doesn’t make a phrase safe.

xkcd 936: Password Strength, Randall Munroe, CC BY-NC 2.5. Four words, as in the comic, is the minimum; today, use six.

Password managers

A password manager stores your sign-in details and generates strong passwords. With one, you don’t have to remember dozens of passwords, only a single master password.

The master password

Memorise the master password and don’t use it anywhere else. A long passphrase works well^[2].

While you’re learning it, you can write it on paper and keep it somewhere safe. Don’t photograph that paper, and don’t keep the password in your phone’s notes.

Which manager to choose

Check that the manager works on all your devices, how to move your data in and out, and how to recover access.

Cloud managers sync between devices:

1Password: the best paid option;
Proton Pass: a good option if you already use other Proton services;
Bitwarden: a good free option for personal use.

Managers with a local vault, whose file you sync yourself, are the KeePass family:

KeePassXC: Windows, macOS, Linux;
KeePassDX: Android;
KeePassium: iOS, macOS.

Do this today

You don’t have to change every password in one evening:

Install a manager, create a master password, and check that the vault opens on the devices you need.
Replace your main email password with a generated one: it can reset the passwords of your other accounts.
Then your financial services, your Apple, Google or Microsoft account, and your work accounts.
Update the rest gradually, as you sign in to each service.

Importing old passwords doesn’t make them safer: reused and weak ones still need replacing. A strong, unique password, on the other hand, doesn’t need changing on a schedule unless there are signs it was stolen.

Next: two-factor authentication and a plan for recovering access.

/bˈɒləks/ - Cybersecurity

Two-factor authentication

Kinds of 2FA

SMS

Authenticator apps

Passkeys

Hardware keys

Not losing access

Recovery codes

If you lose your phone

Backups

Do this today

Passwords

How passwords get stolen

Data breaches

Phishing

Guessing

Malware

Strong passwords

Random passwords

Passphrases

Password managers

The master password

Which manager to choose

Do this today

Further reading