What is two-factor authentication and do I need it?

The answer

Choose a passkey when the service offers one. Otherwise turn on two-factor authentication for at least your email and important accounts.

A password can be exposed through a service breach or a phishing page even when you otherwise act carefully.

The second factor makes it harder to use a stolen password on its own. Store the service’s recovery codes somewhere safe too.

A passkey can replace the password and manually entered code. It recognises the correct domain, so it resists phishing better than a confirmation code you type yourself.

Email deserves priority because many other services send their password-reset links there.

Start with email, then continue with accounts holding payment or personal data. If passkeys are not available, use an authenticator app next and a text message as the remaining option.