Two-Factor Authentication Explained: Prompts, Authenticator Apps, Security Keys and Backup Codes

A password on its own is no longer enough to keep an account safe. Passwords get reused, guessed, and stolen in data breaches, often without the account owner finding out until much later. Two-factor authentication, usually shortened to 2FA, adds a second check at sign-in so that a stolen password by itself does not open the door. It is available on almost every major account you own, it takes only a few minutes to turn on, and the choices you make while setting it up — which second step you pick, and how you store your backup codes — decide how much protection you actually get.

This guide explains how two-factor authentication works, compares the main methods from strongest to weakest, walks through how to turn it on, and covers the mistakes that lock people out of their own accounts. If you are also reviewing your wider sign-in security, start with a good password stored safely — our guide to password managers explained covers that foundation, and passkeys explained covers the newer sign-in method that now sits alongside 2FA on many services.

What two-factor authentication actually is

Two-factor authentication combines two different kinds of proof. The first factor is something you know, normally your password. The second factor is something you have, such as your phone, an authenticator app installed on it, or a physical security key. An attacker who steals or guesses the first factor still cannot sign in, because they do not have the second one. That separation is the whole point: a single leaked secret no longer equals a taken-over account.

Google calls its version 2-Step Verification. With it turned on, you add an extra layer of security to your account in case your password is stolen. After setup, you sign in using your password and a second step, or using a passkey. The second step is a quick confirmation on a device you control, which is why 2FA works best when it is set up carefully rather than switched on in a hurry and forgotten.

The methods, ranked from strongest to most vulnerable

Passkeys and hardware security keys

Passkeys and hardware security keys sit at the top of the list because they are tied to a physical device and give increased protection against phishing. A passkey only exists on your devices. It cannot be written down or accidentally given to a bad actor, and you sign in with your fingerprint, face scan, or device screen lock such as a PIN. When you sign in with a passkey, it bypasses the second step because it already verifies that you are in possession of your device. A hardware security key works in a similar spirit: it is a small device you buy and connect to your phone, tablet, or computer to verify that it is you. Because the confirmation happens on the device itself, there is no code to type into a fake website by mistake.

Google prompts

If you do not use a passkey, Google prompts are Google’s recommended second step. A prompt is a push notification sent to a phone signed in to your account. You tap Yes to allow the sign-in or No to block it. Google notes that prompts are easier than entering a verification code, and that they help protect against SIM swap and other phone-number-based hacks, because the prompt goes to the signed-in device rather than to your phone number.

Authenticator apps

An authenticator app such as Google Authenticator, or another verification-code app, creates one-time codes on your phone. You enter the code shown in the app on the sign-in screen to finish signing in. The important advantage is independence: authenticator apps work when you have no internet connection or mobile service, because the codes are generated on the device itself. For most people, an authenticator app is the practical sweet spot — much stronger than a text message, and available on almost every service that offers 2FA.

Text message and voice-call codes

The weakest common option is a code sent to your phone number. Google sends a 6-digit code by text message or voice call, and you enter it to sign in. It is better than no second step at all, but Google warns that codes sent by text or call can be vulnerable to phone-number-based hacks. If an attacker can redirect your number or intercept the message, they receive the code as well. Use text or call codes only when a service offers nothing better, and upgrade to a prompt, an app, or a key when you can.

Backup codes

Backup codes are not an everyday sign-in method — they are your emergency exit. If you lose your phone, you can use a backup code to sign in. Google lets you print or download a set of 8-digit backup codes and keep them in a safe place. Treat them like spare house keys: anyone holding one can get in, so never give backup codes to anyone. One exception to know about is that you cannot download backup codes if you are in Google’s Advanced Protection Program.

How to turn two-factor authentication on

On a Google Account, the setup path is short. Open your Google Account, go to Security & sign-in, and under “How you sign in to Google” select Turn on 2-Step Verification, then follow the on-screen steps. If the account is provided by your work or school, you may need an administrator’s help, because those accounts can be managed centrally. Two small details are worth knowing before you start. First, if you add a phone number for 2-Step Verification, it may take up to 7 days for Google to trust that number, so do not leave setup until the day you urgently need it. Second, during setup you will be offered the chance to save backup codes — take it, and store them as described below.

Other major accounts follow the same general pattern, even though the menu names differ. Look in the account’s security or sign-in settings for two-step verification, two-factor authentication, or login verification, choose your preferred method — an authenticator app or prompt where offered — and then save the recovery options the service gives you before you close the page. Protect your email account first, because email is the reset point for almost everything else. Once your email is secured, work through your banking, shopping, and social accounts, and then secure the password manager itself if you use one — how to set up a password manager explains why that vault deserves the strongest second step you own.

The phone-change trap most people fall into

The most common 2FA failure is not an attack. It is an upgrade. Someone buys a new phone, wipes or trades in the old one, and only then discovers that their authenticator codes did not move with them. Every account tied to that app is suddenly behind a door they cannot open.

The fix is preparation, done while you still have the old phone in your hand. As general guidance, Microsoft Authenticator offers cloud backup and restore of accounts on a new device, but the backup must be turned on before you switch phones — it cannot be created afterwards from a wiped device. Even with a backup, some account types need re-verification after a restore, so a restored app does not always mean every account works immediately. Before any factory reset or phone swap, save the recovery or backup codes for each important account somewhere separate from the phone, and confirm the authenticator backup is switched on and up to date. Ten minutes of checking before the switch prevents weeks of account-recovery forms afterwards.

Rules that keep two-factor authentication working

Never share verification codes. Never share a verification code with anyone, in any message or call. Scammers may pretend to be support staff or a delivery company precisely to trick you into reading a code aloud, which hands them your second factor. Google will not call you to verify a code, so any caller asking for one is not legitimate — end the call.

Use trusted devices carefully. Many sign-in screens offer a “Don’t ask again on this device” checkbox. That convenience should only be used on devices you regularly use and do not share. Ticking it on a family computer, a work machine, or a borrowed laptop quietly removes the second step for anyone who uses that device later.

Store backup codes away from the phone. Backup codes kept in a note on the same phone they protect are lost in exactly the moment you need them. Print them or download them and keep them in a safe place at home, separate from the device. Never give them to anyone else.

Secure the reset path. Your email account can reset the password on most of your other accounts, so it should have the strongest protection you can give it — ideally a passkey or security key, plus 2FA. An attacker who controls your email can often work around careful security everywhere else.

Related Guides

• How to Turn On Two-Factor Authentication on Google, Microsoft and Apple Accounts
• Authenticator Apps Compared: Google Authenticator, Microsoft Authenticator and Authy
• SMS Codes vs Authenticator Apps vs Security Keys: Which Second Step Is Strongest?
• Lost Your Phone? How Backup Codes and Recovery Methods Save Your Accounts
• Two-Factor Authentication FAQs: Sharing Codes, New Phones and Trusted Devices
• How to Turn On Two-Factor Authentication on Google, Microsoft and Apple Accounts
• Authenticator Apps Compared: Google Authenticator, Microsoft Authenticator and Authy
• SMS Codes vs Authenticator Apps vs Security Keys: Which Second Step Is Strongest?
• Lost Your Phone? How Backup Codes and Recovery Methods Save Your Accounts
• Two-Factor Authentication FAQs: Sharing Codes, New Phones and Trusted Devices
• ChatGPT Now Lets You Lock Chats Behind a PIN — But There’s a Catch

What this means

For years, account security advice centred on the password itself: make it longer, make it unique, change it when a breach is announced. That advice still matters, but it quietly assumed the password would stay secret, and in practice passwords leak constantly — through breached websites, phishing pages, reused credentials, and simple guessing against accounts that never changed a default. Two-factor authentication changes the assumption. It accepts that the password may already be known to someone else and asks a second, separate question that a leaked database cannot answer. In that sense, the second step is no longer a backup to the real protection. For most accounts, it has become the real wall, with the password acting mainly as the first knock on the door.

Which second step you choose matters more than it used to, because phishing has improved. Automated and AI-assisted phishing pages can copy a genuine sign-in screen closely enough to collect both a password and a typed code in real time, then relay them before the code expires. That is why the ranking in this guide is not academic. A code you read and type — whether it arrives by text or from an app — can be passed along by a convincing fake page. A passkey or a hardware security key behaves differently: the confirmation is bound to the device and the genuine service, so there is no reusable secret to hand over. As phishing gets cheaper and more polished, phishing-resistant methods move from a nice upgrade for experts to the sensible default for email, banking, and any account that can reset others.

The honest trade-off is lockout risk. A second factor tied to one phone creates a single point of failure in the opposite direction: lose the phone without preparation and you can lock yourself out more thoroughly than any attacker could. That risk is real, and it is the reason many people hesitate to turn 2FA on at all. But it is a manageable risk, and managing it is a one-time job rather than a daily burden. Backup codes stored on paper at home, authenticator cloud backup switched on before a phone change, and a recovery method checked once a year remove nearly all of the danger. The comparison is not between convenience and security; it is between ten minutes of setup now and an account-recovery process later that may take days and may not succeed.

The practical order of work is simple. Start with your email account, because it resets everything else, and give it your strongest available method. Next, protect your password manager the same way, since it holds the keys to the rest of your accounts. Then work outward to banking, shopping, cloud storage, and social accounts, choosing an authenticator app or prompt wherever a passkey or security key is not offered, and text codes only where nothing better exists. You do not need to do every account in one evening. One important account secured properly each week leaves you, within a month, in a position where a single leaked password — the most common security event in ordinary life — is an inconvenience rather than a disaster.

Read Next

• Password Managers Explained: What They Do and Why You Need One
• Passkeys Explained: How They Work and Why They Are Replacing Passwords

Sources

• Turn on 2-Step Verification — Google Account Help
• Turn On Two-Step Verification: Google, Microsoft, Apple — EpiFive
• Backup and Restore in Microsoft Authenticator — MundoBytes