What is two-factor authentication and which method is most secure?

Two-factor authentication requires something beyond your password, so a stolen password alone is not enough. The methods differ considerably in how much protection they actually provide, and they are commonly treated as interchangeable when they are not.

Text message codes are the weakest common option. They are vulnerable to SIM swapping, where someone persuades a mobile operator to transfer your number to their device, after which they receive your codes. This is not theoretical and has been used repeatedly against high-value accounts. It is still far better than nothing, and for many people it is the only option a service offers.

Authenticator apps generate codes on your device from a shared secret, with nothing transmitted at login. That removes the interception and SIM swap risks entirely. The trade-off is recovery: losing the device without saved backup codes can lock you out permanently, so storing those codes somewhere safe at setup is essential.

Hardware security keys are the strongest widely available method. Beyond being a physical object an attacker must possess, they verify the site domain cryptographically, which means they cannot be used on a convincing fake. That property makes them the only common method that genuinely defeats phishing rather than merely raising the bar.

Passkeys apply the same underlying approach without a separate device, using your phone or computer secure hardware, and are steadily replacing passwords entirely on services that support them.

The practical advice is to use the strongest method each service offers, prioritise your email account above all others since it can reset everything else, and save recovery codes at the moment you enable it rather than later.