A password is something you know — and passwords leak. A data breach, a phishing message or a reused login can hand your password to an attacker. Multi-factor authentication (MFA) adds a second proof of identity that an attacker doesn't have, turning one lost password from a disaster into a dead end.
What Is Multi-Factor Authentication?
Multi-factor authentication (sometimes called two-factor authentication or 2FA) requires you to verify your identity using more than one method before signing in. Typically that means a password plus something from a different category:
- Something you know — your password or PIN.
- Something you have — a phone, security key or authenticator app.
- Something you are — a fingerprint, face or other biometric.
Even if an attacker obtains your password, they still fail the second check, because they don't have your phone or your fingerprint.
Why It Matters
Passwords alone are a weak door. They are reused, phished, leaked and guessed. MFA is the single most effective setting you can turn on for your security: accounts protected by it are dramatically harder to take over, which is why security guidance everywhere makes it a top recommendation — for personal accounts and businesses alike.
Practical Tip
Start with your most sensitive accounts: primary email, banking, cloud storage and social media. One by one is fine — anything is better than nothing.
Common MFA Methods
- Authenticator apps (recommended) — generate time-based codes on your device without needing a signal. They are widely supported.
- Security keys — small hardware devices you plug in or tap; among the strongest options available.
- SMS codes — easy and widely used, but text messages can be intercepted, so treat this as a starter option.
- Biometrics — fingerprint, face or iris scanning on your own enrolled devices.
- Push approvals — "Was this you?" prompts you tap to approve, often built into apps.
Backup Codes and Recovery
Set up recovery options when you enable MFA — save the backup codes the service gives you, or register a second device. Accounts protected by MFA are only painful to lose if you lock yourself out. Keep backup codes somewhere safe and off your main device.
How to Start
- Open the security settings of your most important account.
- Find "Two-factor authentication", "2-Step Verification" or "MFA".
- Install an authenticator app and scan the setup code, or follow the service's preferred method.
- Save your backup codes somewhere safe.
- Repeat for your other important accounts, then set a reminder to review security settings every few months.
Understanding strong passwords helps, but MFA is what catches you when a password fails. Pair them together and your accounts become targets only the most determined attackers would bother with.