Two-factor authentication (2FA) protects an account by asking for two different things when you sign in: something you know, such as your password, and something you have, such as a six-digit code from an authenticator app on your phone. Even if someone steals your password, they cannot get in without the second factor.
It is one of the most effective security steps an ordinary person can take, and it usually takes only a few minutes to set up. This guide explains how 2FA works, which methods to choose, and how to avoid locking yourself out.
Why a password alone is not enough
Passwords leak in many ways. People reuse the same password on several sites, websites get breached, and phishing pages trick people into typing their login details into a fake form. Once a password is known, anyone can try it on your email, social media or online shop account.
2FA adds a second lock. A stolen password on its own is no longer enough, because the attacker also needs the code from your device. This makes many common account takeovers much harder, especially those that rely on reused or leaked passwords.
The main types of second factor
Not all second factors are equally strong. The most common options are:
- Authenticator apps. Apps such as Google Authenticator, Microsoft Authenticator and other compatible apps generate a new six-digit code every 30 seconds. The codes are created on your phone, so they do not travel over the phone network.
- SMS codes. A code is sent by text message. Much better than no 2FA, but text messages can be intercepted or redirected, for example through SIM-swap fraud, where a criminal convinces a mobile operator to move your number to their SIM card.
- Push notifications. Some services send a prompt to an app on your phone asking "Is this you?" Convenient, but never approve a prompt you did not expect.
- Security keys and passkeys. Physical keys or passkeys stored on your device are among the strongest options, because they are designed to resist phishing. Support varies from service to service.
For most people, an authenticator app is a strong and practical choice. If a service only offers SMS, turn it on anyway. It is still a big improvement over a password alone.
How authenticator apps work
When you turn on 2FA with an authenticator app, the website shows you a QR code. That QR code contains a secret key. You scan it once with your authenticator app, and from then on, the app and the website both use that shared secret and the current time to calculate the same six-digit code.
Because the code changes every 30 seconds, a code someone sees over your shoulder is useless shortly afterwards. And because the codes are calculated on your phone, the app works even without an internet connection.
One important point: the setup QR code is sensitive. Anyone who scans it can generate your codes. Do not screenshot it, share it or leave it on screen where others can see it.
How to set up 2FA step by step
The exact menus differ between services, but the process is usually the same:
- Install an authenticator app on your phone.
- Sign in to the account you want to protect and open its security settings.
- Look for "Two-factor authentication", "Two-step verification" or "2-step sign-in" and choose the authenticator app option.
- Scan the QR code shown on screen with your authenticator app.
- Type the six-digit code from the app to confirm it works.
- Save the backup codes the service gives you (see the next section).
- Sign out and sign in again to check everything works.
Start with the accounts that matter most: your main email (because it can reset other passwords), banking, social media, cloud storage and any account that holds payment details. On QR-TH you can turn on two-step sign-in with an authenticator app from your account settings, which protects your QR codes and short links from being changed by someone else.
Backup codes: your way back in
The most common 2FA problem is not hacking. It is losing your phone. If your phone is lost, stolen, broken or replaced, you need another way to sign in.
That is what backup codes are for. Most services give you a list of one-time codes when you turn on 2FA. Each code can be used once instead of the app code.
Store them safely:
- Print them and keep the paper somewhere secure at home, or
- Save them in a reputable password manager, and
- Do not keep them only on the same phone as your authenticator app.
Each backup code works only once. When you use one, cross it off. If you run low, most services let you generate a fresh set, which cancels the old ones.
Changing phones without getting locked out
Before you reset, sell or trade in an old phone, move your authenticator codes to the new one. Some authenticator apps offer a transfer or cloud backup feature; others require you to set up 2FA again for each account.
A safe approach:
- Keep the old phone working until every account is confirmed on the new one.
- For accounts that cannot be transferred, sign in, turn 2FA off and on again, and scan the new QR code with the new phone.
- Test each account before wiping the old device.
Common 2FA mistakes to avoid
- Sharing codes. No genuine bank, shop or support team will ask you to read out a 2FA code. Anyone who asks is very likely a scammer.
- Approving unexpected prompts. If you get a sign-in request you did not start, deny it and change your password.
- Typing codes into pages you reached from a link in a message. Phishing sites can ask for your code too. Go to the website directly instead.
- Skipping backup codes. It takes a minute to save them and can save days of account recovery.
For more everyday protection, read our mobile security tips, and learn how to spot QR code scams that try to steal login details.
FAQ
Is two-factor authentication really necessary?
For important accounts such as email, banking and social media, yes. It blocks many attacks that rely on stolen or reused passwords.
Is an authenticator app safer than SMS?
Generally, yes. Authenticator codes are generated on your phone, while SMS codes can be intercepted or redirected through SIM-swap fraud. SMS is still better than no 2FA.
What happens if I lose my phone?
Use one of your saved backup codes to sign in, then set up 2FA again on your new phone. Without backup codes, you will need the service's account recovery process.
Can someone hack my account if they have my 2FA code?
A code is valid only for a short time, but a scammer who tricks you into sharing it in real time could use it. Never share your codes with anyone.
Two-factor authentication takes a few minutes and makes your accounts far harder to break into. Turn it on for your email and banking today, then protect your QR-TH account with two-step sign-in. You can read more in our FAQ.