Is SMS-based 2FA secure enough?

SMS 2FA is significantly more secure than a password alone — it stops automated credential-stuffing attacks and most opportunistic account takeovers. However, it's vulnerable to SIM swapping, where an attacker convinces your mobile carrier to transfer your number to their SIM. SIM swapping attacks require targeting a specific person and are less common than mass automated attacks. For most people, SMS 2FA is a major security improvement. For high-value targets (politicians, executives, people with large crypto holdings), authenticator apps or hardware security keys are worth the extra effort.

What happens if I lose my phone with my authenticator app?

If you saved backup codes during setup, use one of those to log in — each code works once. If you didn't save backup codes, you'll need to use the account's account recovery process, which varies by service and can take days. This is why saving backup codes is non-negotiable. After regaining access, immediately set up 2FA on a new authenticator app. Going forward, Authy's cloud backup feature stores your 2FA accounts encrypted online, letting you restore them to a new phone — this is worth setting up proactively.

Which authenticator app should I use?

Google Authenticator: simple, widely supported, no account required, but no backup — if you lose your phone, your 2FA accounts are lost. Authy: adds encrypted cloud backup and multi-device sync, requires a phone number to create an account. Microsoft Authenticator: good if you're in the Microsoft ecosystem, supports passwordless sign-in for Microsoft accounts, includes cloud backup. All three are free and functional. For most users, Authy's backup feature makes it the most practical choice.

Does every website support 2FA?

No — 2FA adoption varies widely. Almost all major services support it: Google, Apple, Microsoft, Facebook, Instagram, Twitter/X, GitHub, Dropbox, and most banks. Smaller services and older systems may not. You can check whether a specific service supports 2FA at twofactorauth.org, which maintains a searchable directory. If a service you care about doesn't support 2FA, consider whether a stronger unique password and careful phishing hygiene compensates for the lack of a second factor.

How to Set Up Two-Factor Authentication (And Why You Should)

2FA stops most account takeovers even when your password is already known. Here’s how to enable it on your most important accounts in a few minutes.

Quick Answer

✓Enable 2FA on your email account first — email is used to reset every other account, making it the highest-value target.
✓Use an authenticator app (Google Authenticator, Authy, or Microsoft Authenticator) rather than SMS where possible — apps are more secure than text codes.
✓Save the backup codes provided during setup in a secure location — these let you back in if you lose your phone.
✓After email, prioritize: banking, password manager, social media, and any account tied to financial information.

How to Set Up 2FA

Understand what two-factor authentication does

Two-factor authentication (2FA) adds a second verification step beyond your password. After entering your password correctly, you're asked for a second factor — typically a 6-digit code that expires every 30 seconds, generated by an app on your phone or sent via SMS. Even if someone obtains your password through a data breach or phishing attack, they cannot access your account without the second factor. This stops the vast majority of automated account takeover attempts.

Choose an authenticator app or SMS

You have two main options for the second factor. Authenticator app: an app on your phone generates time-based codes (Google Authenticator, Authy, or Microsoft Authenticator — all free). This is the more secure option. SMS: a text message is sent to your phone number with a code. This works without installing an app but is less secure due to SIM swapping attacks. For most people, either option is dramatically better than no 2FA. Download an authenticator app before proceeding to the next steps.

Pro tip: Authy has a backup feature that lets you restore your 2FA accounts to a new phone — Google Authenticator does not (it requires re-linking accounts after a phone change). If backup matters to you, Authy is the better choice.

Enable 2FA on your email account first

Email is your highest-priority account because it's used for password reset on every other service. Find 2FA in your email provider's security settings: Google: myaccount.google.com > Security > 2-Step Verification. Apple: appleid.apple.com > Sign-In and Security > Two-Factor Authentication. Microsoft/Outlook: account.microsoft.com > Security > Advanced security options. Follow the setup flow, scan the QR code with your authenticator app, and confirm the code works before finishing.

Save the backup codes in a secure location

After linking your authenticator app, most services provide 8–10 single-use backup codes — these let you access your account if you lose your phone. This step is critical: without backup codes and without your phone, you may be permanently locked out. Store backup codes in a password manager, or print and store them somewhere only you can access. Do not store them in email (which is the account you're trying to protect) or in cloud notes that aren't secured.

Enable 2FA on your remaining important accounts

After email, work through your other high-value accounts in priority order: (1) Password manager — if you use one, this is critical since it holds everything else. (2) Banking and financial accounts. (3) Social media accounts, which are increasingly used for account recovery elsewhere. (4) Shopping accounts with saved payment methods. (5) Any service where you store sensitive personal information. Each service has slightly different settings paths — search '[service name] enable two-factor authentication' for exact steps.

Test the 2FA setup before logging out

Before closing the setup flow, verify the 2FA is working: log out of the account on one device and log back in. You should be prompted for your password, then immediately after for the authenticator code. Open your authenticator app, enter the 6-digit code for that account (it refreshes every 30 seconds), and confirm you get in. This confirms the setup is correct — it's much easier to troubleshoot during setup than after you've been locked out.