Two-Factor Authentication: The Guide

By NorwegianSpark Editorial · Published June 1, 2026 — written with AI assistance and reviewed by the NorwegianSpark SA editorial team.

Two-factor authentication (2FA) means that logging in needs your password plus a second proof — a code from an app, a text message, a tap on a security key or a passkey — so a stolen password alone is not enough. Turn it on first for your email and your password manager, prefer an authenticator app, a security key or a passkey over SMS, and save your backup codes before you need them. The US cybersecurity agency CISA puts it plainly: "Users who enable MFA are significantly less likely to get hacked."

If a password manager is the highest-value security habit, two-factor authentication is a very close second — and together they stop the overwhelming majority of account takeovers. 2FA means logging in requires something you know (your password) plus something you have (a code or key), so a stolen password alone is not enough. Understanding the methods, which vary a lot in strength, lets you protect what matters most.

Ranked roughly from strongest to weakest: hardware security keys (a physical device, extremely phishing-resistant) are the gold standard for critical accounts; authenticator apps that generate rotating codes are strong and convenient for everyday use; and SMS codes are better than nothing but the weakest, vulnerable to SIM-swapping, so avoid SMS for important accounts where a better option exists. Password managers such as NordPass and Proton Pass — whose paid Pass Plus plan includes a built-in 2FA authenticator — increasingly integrate 2FA handling, keeping it convenient enough that you actually use it.

The practical priority: enable 2FA first on the accounts that unlock everything else — your primary email and your password manager — then your financial and important accounts. Email is the master key; protecting it well protects most password resets.

This is the natural partner to our password managers guide and underpins everything from identity theft protection to general online privacy, and it points toward passkeys, which build phishing-resistance in from the start. No VPN or antivirus matters much if an attacker can simply log into your accounts.

Why the Ranking Is What It Is

The security ordering of second factors follows from one question: can it be relayed to an attacker by a convincing fake login page?

The bottom row is categorically different rather than incrementally better. A security key checks the site's identity before it responds, so a fake page cannot obtain anything reusable. Everything above it depends on you correctly identifying the site, which is precisely what phishing defeats. CISA says the same in one line: "The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication." The mechanism is in passkeys explained.

How to set up 2FA on an account

The wording differs by service, but the pattern is the same almost everywhere:

• Open the account's security or sign-in settings and look for two-step verification, two-factor authentication or passkeys.
• Choose the strongest method offered: a passkey or security key first, then an authenticator app, and SMS only if nothing else exists.
• For an authenticator app, scan the QR code the site shows, then type the six-digit code to confirm.
• Save the backup codes the site gives you before you close the page.
• Sign out and back in once to confirm it works.

SIM Swap Is the Reason to Move Off SMS

The attack does not touch your phone. Somebody persuades your mobile operator to move your number to their SIM, and from that moment every SMS code goes to them. Two consequences:

• Your mobile account is a security account. Put a port-out PIN or account passcode on it, and treat it with the same care as your email.
• Remove SMS as a recovery method where the service allows an alternative. Leaving it enabled as a backup keeps the weakest path open regardless of what else you added.

The full mechanics are in SIM swap attacks.

Recovery Is Where People Actually Lose Access

Far more people lock themselves out than are attacked. Do all of this at enrolment:

• Save backup codes somewhere that survives losing the phone — printed, or in a password manager on a different device.
• Enrol a second factor: two hardware keys, or an app on a second device.
• Check whether your authenticator app backs up its secrets, and whether that backup is encrypted. Some do, some do not, and the difference is discovered at the worst moment.
• Re-check after changing phones. Migration silently drops entries more often than it should.

Where to Turn It On First

• Email, because it resets everything else.
• Your password manager, because it holds everything else.
• Your mobile carrier account, which is what SIM-swap attacks target.
• Banking and payment.
• Cloud storage and anything tied to work.
• Social accounts, especially any you use to sign in elsewhere.

Then, as passkey support widens, replace codes with passkeys on those same accounts in the same order. For how attackers obtain the first factor in the first place, see phishing: how to spot and avoid it.

Turn on 2FA, prefer apps or hardware keys over SMS, and protect your email first. Hardware keys, and the password managers that store your second factors, are covered in our shortlist of security tools. General guidance.

Continue in this collection

Best Security Tools

The shortlist across antivirus, VPN and password managers, and the reasoning.

Explore

Live Offers

What is actually discounted right now, rather than what once was.

Explore