What is two-factor authentication?
Two-factor authentication (2FA) asks for two different kinds of proof when you sign in: something you know (your password) and something you have or are (your phone, a security key, your fingerprint). A stolen password alone is no longer enough.
2FA methods, from strongest to weakest
| Method | How it works | Phishing-resistant |
|---|---|---|
| Hardware security key | A USB/NFC key (e.g. YubiKey) signs a challenge | Yes |
| Passkey / biometrics | Face ID, Touch ID or Windows Hello unlocks a device key | Yes |
| Authenticator app (TOTP) | A 6-digit code that changes every 30 seconds | Partly |
| Push notification | Approve a prompt on your phone | Partly (beware “prompt bombing”) |
| SMS code | A code sent by text message | No (SIM swapping) |
Any 2FA is far better than none. Where you can, prefer passkeys or security keys; otherwise use an authenticator app.
Which accounts need 2FA first?
- Your email — it can reset every other password.
- Your password manager — it holds the keys to everything else.
- Banking and payments.
- Your phone’s cloud account (Apple ID, Google account).
- Social media and work accounts.
How to set up an authenticator app
- Install an authenticator app on your phone.
- In the website’s security settings, choose “Authenticator app”.
- Scan the QR code shown on screen.
- Type the 6-digit code to confirm.
- Save the recovery codes somewhere safe — a password manager note is ideal.
Don’t lock yourself out
- Register two second factors where possible: for example a passkey on your laptop and one on your phone.
- Store backup codes in your password manager, not in screenshots.
- When changing phones, move your authenticator accounts before wiping the old one.
Real-time phishing: why codes are not enough
Modern phishing kits sit between you and the real site, forwarding your password and your 6-digit code instantly. Passkeys and security keys defeat this because they check the website’s real domain. A password manager helps too: it will not offer to fill your password on a fake domain — a strong hint something is wrong.
2FA in Lockvero
Lockvero supports passkeys and hardware keys (WebAuthn) and authenticator apps (TOTP) for your account, emails you about new sign-ins and 2FA changes, and lets you sign out any device remotely. See all features.
Put it into practice
Lockvero keeps every password strong, unique and encrypted on your device. Free forever plan.
Create your free vault