Use two-factor authentication

Updated28 March 2024

Two-factor authentication (2FA), also called multi-factor authentication (MFA), adds a second factor of authentication to your login system, so that if you want to log into an account you need something that you know (the password or passphrase) and something that you own (for example a hardware device, an app generating one-time codes or a phone to receive SMS messages or confirm your log-in).

By using 2FA, you can make sure that even if someone manages to guess your password, they cannot log in because they still need a second factor, which is harder to get as it is only valid once and is either generated by a physical device owned by you or sent to you in the exact moment you need it.

Learn how to set up two-factor authentication

• To check which services offer 2FA and find links to instructions hosted by each service on how to enable 2FA, see the 2FA Directory website.
• It is crucial to set up 2FA for:
  • your bank accounts or money apps,
  • accounts like your email address, social media, file storage, any accounts with sensitive or private information and accounts you would need in order to recover access to any other account.

Use an authenticator app or a hardware device

Your two-factor authentication options may include:

• Using an authenticator app or program.
  • We recommend the Aegis app on Android, the Raivo OTP app on iOS/iPhone, or FreeOTP for Android and iOS.
  • You can also set up 2FA with KeePassXC, KeePassDX or Strongbox.
  • When using this option, it's important that you protect your device where the 2FA app is installed from malware.
• Using a hardware device - often called a security token, dongle, USB "key" or FIDO U2F key (Fast IDentity Online Universal 2nd Factor) - which you can plug into your computer or phone or set up to use for wireless communication, e.g. with NFC (near-field communication).
  • Some examples are Yubikey, Nitrokey, Google Titan Key, Thetis Key and Solokeys.
  • Note that some hardware devices may not be usable on mobile devices. Before you purchase a hardware device, check if it can connect to your phone or computer.

Choose the 2FA method that works best for you

• You can use one authenticator app or hardware device for multiple services, or set up different services with different forms of 2FA for additional protection.
• While authenticator apps and hardware devices do not require any kind of connection to generate codes, other methods will require connection to the mobile network (SMSs for 2FA) or to the internet (email for 2FA).
• Ranking 2FA options in order of safety: an authenticator app or hardware device is safest, then email, then SMS. Also SMS may not reach you if you are in another country or without coverage.
  • We do not recommend using SMS text messages for 2FA since they are not encrypted and there have been cases of attackers successfully intercepting them on their way.
• Do not disable two-factor authentication once you have set it up. Some services may offer you the option to turn it off for a while for convenience, but consider the impact this might have on your security.

Keep 2FA backup codes safe and separate

When you activate 2FA for a service, it is very important to make sure that you can rely on a backup 2FA method so that if you lose the device you are using for 2FA you can still log into your account with another method.

In most cases the backup 2FA method consists in a series of 2FA codes you can download and store in a safe place. If backup 2FA codes are not provided automatically, look for a way to manually generate them. If this is not possible, try enabling an alternative 2FA method - for example you can add a hardware device if you already registered an authenticator app, or take a screenshot of the QR code you have scanned when setting up your authenticator app and make a secure backup of it.

• If you are given backup codes when you set up 2FA, store these codes in a password manager, as an attachment to the entry for the relevant account. Learn how to do this in your password manager of choice:
  • KeePassXC.
  • KeePassDX.
  • Strongbox.
• Ideally, to keep these codes separate from other information that could be used to access your accounts, create a separate database with your password manager and save it on another device.