Two-factor authentication (2FA)
Two-factor authentication (2FA) means that logging in requires a second, independent proof besides the password — such as a code from an app or a security key.
Passwords get stolen, guessed or published in data leaks. With 2FA the password alone is no longer enough: an attacker would also need the smartphone or security key.
Common second factors are authenticator apps, security keys and passkeys. Codes via SMS are better than nothing but are considered the weaker option.
2FA is especially important for email accounts, domain and hosting access, code platforms, accounting, CRM and all admin accounts — wherever a single login enables great damage.
What to look out for
- Activate 2FA first for email, domain, hosting, code platforms and administration.
- Prefer an authenticator app or security key over SMS.
- Store recovery codes securely and separately.
- Make 2FA mandatory in the team, not just recommended.
- Revoke access and second factors immediately when employees leave.
Common mistakes
- 2FA only for some accounts, the most important email inbox remains unprotected.
- Recovery codes sit on the same device or get lost.
- Shared accounts without 2FA because “several people need access”.
Frequently asked questions
Better than no second factor, but authenticator apps, security keys and passkeys are considered more secure.
With the recovery codes saved during setup or a second registered factor you can regain access. That is why these codes should be stored securely and separately.
More in our article: Website security: the basics every business needs