Two-Factor Authentication Basics: TOTP, SMS, Keys, and Recovery

Two-factor authentication asks for two different kinds of proof before it lets you in, usually a password plus a code or a hardware key. A leaked password is often not enough to take the account when the attacker does not have that second factor. Turn it on for primary email first, because email can reset the other accounts. SMS stops many random guesses and is still weaker than an authenticator app or a hardware key, because of SIM swaps and intercepted texts. Use SMS when the site offers nothing else. Recovery codes are single-use, and they belong somewhere other than the phone you are protecting. The password that sits next to MFA can come from the password generator. This page also links the hash generator and the UUID generator.

Passwords show up in breach databases often. Services such as Have I Been Pwned make that visible, and "new login" alerts show how often reused credentials get tested. Changing the password helps. Two-factor authentication on email often stops the takeover because the attacker still lacks the second factor.

MFA (multi-factor authentication) is one of the highest-value security upgrades after unique passwords. People mix up SMS, app codes, and hardware keys, lose recovery codes in a junk drawer, and postpone setup until the next lockout ticket. This guide covers what to enable, in what order, and how to avoid locking yourself out.

For the password that pairs with MFA, see What Makes a Strong Password. For where to store credentials, see Password Managers vs. Browser Save.

What "second factor" means

Authentication factors fall into categories:

1. Something you know: a password or a PIN
2. Something you have: a phone, a hardware key, or a smart card
3. Something you are: a fingerprint or a face

Two-factor means two different categories. A password and a security question are both things you know, so together they are still one category. A password plus an SMS code is two categories: knowledge, plus possession of the SIM. That possession is imperfect.

Multi-factor (MFA) sometimes means two or more factors. In consumer settings, "2FA" and "MFA" are used interchangeably.

The goal is that a password stolen from a breach cannot, by itself, unlock the account.

Methods ranked for typical users

| Method | Security | Convenience | Notes | |--------|----------|-------------|-------| | Hardware security key (FIDO2/WebAuthn) | Highest | Medium. You carry the key | Phishing-resistant | | Authenticator app (TOTP) | High | Good. Works offline | 6-digit codes rotate every 30s | | Push notification (app approve) | High | Very easy | Watch for MFA fatigue prompts | | SMS text code | Moderate | Easy | SIM swap risk | | Email code | Low to moderate | Easy | Weak if the email account itself is compromised | | Backup codes | Recovery only | N/A | One-time use each |

A practical order:

1. Today, turn on any second factor the email account offers. A password-only email account is the one to fix first
2. Move email and the password manager to an authenticator app or a key
3. Replace SMS on high-value accounts where the site allows an app or a key
4. Save recovery codes before you need them

TOTP authenticator apps

Time-based One-Time Password (TOTP) apps such as Google Authenticator, Microsoft Authenticator, Authy, 1Password's built-in generator, and Bitwarden produce six-digit codes synced to the server clock.

Setup flow:

1. In account security settings, enable 2FA
2. Scan the QR code with the app, or enter the secret manually
3. Enter the current code to confirm
4. Download the recovery codes. That step is required. It is not a footer you can skip

What you gain: the app works offline, on a plane. There is no SMS to intercept. Support is widespread.

What you can lose: the phone, with no backup, means a lockout. Mitigations:

• A cloud backup of the TOTP secrets (Authy or 1Password). Understand the tradeoff of that backup
• A second device enrolled
• Printed recovery codes in a safe
• A hardware key as an alternate factor

Clock skew breaks TOTP. Turn on automatic time on the phone.

SMS codes

Banks and older sites still default to SMS. It stops credential stuffing from attackers who do not have your phone.

Weak points:

• SIM swap: an attacker ports your number
• SS7 attacks: rare, and real at nation-state scale
• Phone theft, if SMS previews on the lock screen

Use SMS when it is the only option. Prefer an app or a key on email, cloud storage, and the password manager, even when the bank still texts you.

Hardware security keys

YubiKey, Google Titan, and platform keys: you insert the key or tap NFC during login. The method is phishing-resistant when the site supports FIDO2/WebAuthn properly. A fake login page cannot reuse the cryptographic challenge.

Good fits: a Google account, a Microsoft work account, GitHub, Cloudflare, and the password manager's master unlock.

Carry two keys, one primary and one backup in a different place, or enroll more than one factor so a single lost key is not a catastrophe.

Push prompts

"Is this you logging in?" notifications are easy until MFA fatigue sets in. Attackers spam prompts until you tap Approve to silence the phone.

If you did not just try to log in, deny the prompt and change the password. Approving a prompt only to stop the noise is how the attack succeeds.

Number matching, where Google or Microsoft shows digits you must confirm on screen, reduces blind approval.

What to protect first

For most people, this order:

1. Primary email. It resets everything else
2. The password manager. It holds the other logins
3. Cloud storage (Drive, iCloud, Dropbox): documents and photo backups
4. Banking and payment apps
5. Work SSO, Microsoft 365, or Google Workspace
6. Social media tied to your identity or to ads billing
7. Everything else, when you are bored on a Sunday

MFA on an abandoned forum does less than a hardened email account.

Recovery codes

When you enable 2FA, sites offer 8 to 10 single-use recovery codes. They are part of the setup, not an optional extra.

Store them:

• Printed, in a home safe or a locked drawer
• Separate from the laptop bag
• Somewhere other than a screenshot on the phone you are protecting
• Somewhere other than a plaintext email to yourself titled "codes"

Poor places to keep the only copy:

• Only on the phone that dies in a pool
• A shared Slack channel "for backup"

If the codes are used up or lost, vendor account recovery may take days. For consumer Gmail it can be impossible without a recovery setup you arranged earlier.

Passkeys

Passkeys use device biometrics (Face ID or a fingerprint) or a PIN, with public-key cryptography. You sign in without typing a password, and the sign-in resists phishing.

They often replace the password on sites that support them, so they are not the classic pattern of "password, then a second factor." Still enable MFA on email and on recovery accounts. A passkey on a shopping site does not help if an attacker resets that shop through email.

Passkey sync (Apple iCloud Keychain, Google Password Manager) is convenient. Know which cloud you are trusting.

Workplace MFA

Employers require an authenticator app or a key for VPN and email. A personal phone enrolled for work TOTP blurs the boundary. Use a separate profile, or the work MDM policy, if that is required.

Do not approve a work push login you did not start. Report it to security.

Lockouts to avoid

• A new phone, the old phone factory-reset, no recovery codes, and no backup of the TOTP secrets
• Switching authenticator apps without transferring the secrets
• SMS as the only factor, then the number gets recycled to a stranger
• 2FA turned on for the password manager, with the recovery codes stored inside that same vault

Once a year, log in with the backup method on purpose so you know it still works.

MFA and the clipboard

Some workflows still copy a TOTP code by hand. That overlaps with Clipboard Security for Sensitive Data. Prefer on-device autofill. The codes expire in 30 seconds anyway.

A 30-minute setup

1. In the email provider's security settings, add an authenticator app
2. Print the recovery codes, or store them offline
3. On the password manager, enable 2FA and save the new recovery codes somewhere else
4. Do the same for cloud storage
5. Where an app is allowed, remove SMS as the only factor
6. Register a hardware key if you own one

Log out and back in before you close the laptop.

When MFA still leaves a gap

These still get through:

• Session hijacking after you are already logged in
• Malware on the device after login
• A support agent who resets the factors because someone talked them into it
• You, approving a phishing push

Pair MFA with unique passwords, an updated OS, and skepticism toward unsolicited links, including Phishing PDF Attachments.

Sources

• NIST SP 800-63B, Digital Identity Guidelines (Authentication): authenticator types and assurance levels
• CISA, Turn On Multifactor Authentication: public MFA guidance
• CISA, Secure Our World: layered cyber hygiene practices

Last reviewed: October 2026. Sources and scope clarified for accuracy.

Conclusion

Start with email. Use an authenticator app or a hardware key where you can. Use SMS where it is the only option the site gives you. File the recovery codes where a drowned phone cannot take them along.