A password is something you know. The second factor is something you hold: a phone, an app, a physical key. The point is that a stolen password is no longer enough — the attacker knows the secret but is not holding your device.
It is the only measure that still works after a password has leaked, which is why it deserves to be switched on before you start changing passwords.
Three methods and how they differ
SMS — better than nothing
A code arrives by message. Available everywhere and needs no setup, but it has a weak point: the number can be taken over. The scheme is called SIM swapping — an attacker restores a “lost” card using documents or a shop employee, and the codes start arriving to them.
A separate problem is roaming and poor coverage: the code fails to arrive exactly when you need it most.
Authenticator app — the sensible choice
The app shows a six-digit code every thirty seconds. It is computed from a shared secret and the current time, so no internet is needed at all — it works on a plane and without a SIM card.
The code can only be stolen along with the phone, or through a fake site where you type it in yourself. Against SIM swapping the method is immune.
One detail during setup: save the secret key or the QR code shown when you connect it. With it you restore access on a new phone without contacting support.
Hardware key — the maximum
A physical device you plug in or tap against the phone. It verifies the site address cryptographically, so a fake page cannot work in principle: the key simply does not answer a domain it was not registered for.
It is the only method resistant to phishing. Downsides: cost, carrying it around, and the need for a second key in case the first is lost.
How the app knows the code while offline
When you enable it, the service shows a QR code containing a shared secret — a random string. The app stores it, the service stores it, and after that they exchange nothing.
From then on both sides take the current time, round it down to a thirty-second step and compute HMAC-SHA1 of that number with the shared secret. Six digits are cut out of the result. Because the time is the same for everyone and the secret is shared, the codes match without a single network request.
Two practical consequences. First: the app works on a plane and without a SIM card. Second: if the phone clock drifts badly, codes stop matching — check automatic time sync.
Backup codes: do this immediately
When you enable a second factor the service issues a list of one-time codes. They are shown once, and they are the only way in when the phone is lost, broken or wiped.
The typical mistake is saving them as a screenshot in the gallery of that same phone. When the phone goes, the codes go with it.
Keep them in a password manager, which syncs between devices, or print them and file them with your documents. Verify they are really saved before you need them.
Where it is mandatory
Email. Everything else is recovered through it, which makes it the first item rather than the last.
Banking and government services. Often required already, but check that it is not SMS.
The password manager. A vault holding every password is an obvious target.
Work systems and social media. A stolen work account hurts more than you, and a stolen social account is used for fraud in your name.
What a second factor does not protect
It is useless against fake sites if you type the code into the attacker’s page yourself — they relay it to the real service in real time. Only a hardware key, or the habit of checking the address bar, helps there.
It also does not replace a strong password: it is a second line, not a substitute for the first.