Two-factor authentication and passkeys, step by step
Two-factor authentication adds a second proof of identity to your password, such as a code from an app, a prompt on your phone, or a security key, so that a stolen password is no longer enough to get into your account. Passkeys go further by replacing the password altogether, and they are designed to resist fake login pages.
How two-factor authentication and passkeys protect your accounts
You have a password manager, or you are about to set one up, and you want to make sure that a leaked or phished password cannot open your accounts. That is step three of the plan to lock down your accounts, and it is the step with the best ratio of effort to protection. The UK’s National Cyber Security Centre recommends turning on 2-step verification on all your important accounts, even those protected by strong passwords.
The names vary, which does not help. Two-factor authentication (2FA), two-step verification (2SV), and multifactor authentication (MFA) all describe the same idea: logging in takes something you know, your password, plus something you have, such as your phone or a key, or something you are, such as your fingerprint. Passkeys are a newer approach that combines those factors in one step and removes the password.
How much difference it makes
A second factor turns a stolen password into a much smaller problem. In its 2025 Digital Defense Report, Microsoft reported that multifactor authentication blocks over 99% of unauthorized access attempts. The remaining risk comes mostly from attacks that trick you into approving a login or typing a code into a fake page, which is why the method you choose matters.
The methods, from strongest to weakest
The US Cybersecurity and Infrastructure Security Agency ranks the common methods by how well they keep attackers out. Its guidance for businesses puts them in this order:
| Rank | Method | How it works | Main weakness |
|---|---|---|---|
| 1 | Security key | A small device you plug in or tap | You must keep a spare in case you lose it |
| 2 | App with number matching | Your phone shows a number you type or confirm | Requires a smartphone and an app |
| 3 | App with a one-time code | An authenticator app shows a short code that changes regularly | A fake login page can ask for the code |
| 4 | Biometrics | Your fingerprint or face, usually on your phone | Depends on the device |
| 5 | Code by text message or email | A code sent to your phone number or inbox | Weakest: numbers and inboxes can be taken over |
CISA adds that any multifactor authentication is better than none, and the NCSC says the same about 2SV. If text messages are the only option a service offers, turn them on.
Passkeys sit at the top of this scale too. They are built to resist phishing, and in April 2026 the NCSC announced that it no longer recommends passwords where passkeys are available.
Picking a second factor
If you are setting up 2FA for the first time, the choice between text messages, an authenticator app, and a security key depends on what you protect and what devices you carry. Our guide to choosing the right second factor explains the trade-offs, including SIM swapping and what it means for text message codes.
Choosing an authenticator app
Google Authenticator, Microsoft Authenticator, and several independent apps do the same basic job, but they differ on backup, transfer to a new phone, and export. The comparison of authenticator apps and their backup options helps you pick one you will not lose access to.
What a passkey actually is
A passkey replaces your password with a pair of keys: one stays on your device, the other on the website. You unlock it with your fingerprint, face, or PIN. The page on how passkeys work and how they compare with passwords explains why they resist fake login pages, where they are stored, and their current limits.
Turning passkeys on
The big platforms now let you sign in with a passkey, each in its own way. Follow the step-by-step setup for Google, Microsoft, and Apple, including how to remove a passkey you no longer want.
Physical security keys
Security keys such as a YubiKey offer the strongest protection, at a price and with a little discipline: you need a spare. Our page on whether you need a hardware key covers who benefits, what they cost, and which services accept them.
When you change or lose your phone
The most common 2FA problem is not an attack but a lost, broken, or replaced phone. Read how to keep access when your phone changes before it happens: backup codes, app transfers, and recovery options for each platform.
Where to start
You do not need to do everything this week. Our list of the accounts to protect first starts with your main email account and works through the domain registrar, banking, and social media. In a team, follow the same order for each person, beginning with anyone who has administrator rights, because their accounts can change everyone else’s.
More on securing your accounts
The second factor protects the login; the password behind it still needs to be unique. If you have not set up a password manager yet, start with where to keep your passwords and how to choose a manager. A second factor does not stop every scam, so learn the scams aimed at small firms; if an account is already compromised, see taking back control of an account; and to bring everyone along, see account security for small businesses.