← Privacy Guides

Accounts & identity

Two-factor authentication: use an app, not SMS

Add a second step to your important logins so a stolen password is not enough, and choose a method in the right order: a passkey or hardware key first, an authenticator app next, and text-message codes only as a last resort.

  • Low threat
  • Time 30 minutes
  • Difficulty Easy
  • Last verified

What this protects, and what it doesn't

Protects

  • Password reuse and breaches: a leaked or guessed password alone no longer gets someone into the account.
  • Credential-stuffing: automated attacks that replay leaked passwords across sites are stopped at the second factor.
  • With an authenticator app, the code is generated on your device and never travels over the phone network, so it cannot be intercepted the way an SMS can.

Does not protect

  • Phishing of app and SMS codes. A convincing fake login page can ask you for the 6-digit code and relay it in real time. Only passkeys and hardware keys resist this; app codes are much better than SMS but not phishing-proof.
  • A compromised device. Malware on the phone that holds your codes can read them; 2FA assumes the device itself is trustworthy.
  • Account-recovery weaknesses. If the "forgot password" flow falls back to email or SMS, an attacker may go around 2FA entirely (see the recovery guide).
  • Losing access if you keep no backup. A phone that is lost, stolen or wiped takes its codes with it unless you saved backup codes or an encrypted export.

Prerequisites

  • A short list of your important accounts: email, password manager, bank, and the social and cloud accounts that matter.
  • A phone or computer for the authenticator app, and somewhere safe (offline or in your password manager) to store backup codes.

Step by step

  1. Know the order of strength

    Not all second factors are equal. From strongest to weakest:

    1. Passkey or hardware security key (FIDO2/WebAuthn): bound to the real site, so a phishing page cannot use it. Prefer this wherever it is offered (see Passkeys and hardware security keys).
    2. Authenticator app (TOTP): a short code (typically 6 digits) that changes about every 30 seconds, generated on your device. Works offline and is not tied to your phone number.
    3. Text message (SMS) code: better than nothing, but the weakest option — vulnerable to SIM swaps and network interception (see Defend against SIM swaps). Use it only when a site offers nothing else.

    This guide sets up the middle option, the authenticator app, because almost every site supports it.

  2. What an authenticator app actually does

    When you turn on app-based 2FA, the site shows a QR code that contains a shared secret. Your app stores that secret and, using the open TOTP specification (RFC 6238, published as Informational), combines it with the current time to produce a code — typically 6 digits, changing about every 30 seconds — that both sides can compute independently. Nothing is sent over the network to generate the code, which is exactly why it cannot be intercepted like an SMS. The only things that matter are that the secret stays on your device and that your clock is roughly correct.

  3. Choose an authenticator app

    Any TOTP app produces the same codes; pick one with a backup story you understand. Open-source options are preferable because the code can be inspected. Common choices, each with its own documentation to confirm:

    • Aegis (Android, open-source): strong local, encrypted backups you export and control; no built-in cloud sync.
    • Ente Auth (open-source, cross-platform): works offline without an account, and offers end-to-end encrypted sync across your devices if you create one.
    • 2FAS (open-source, cross-platform): simple, with optional backup to your own iCloud or Google Drive.
    • Proton Authenticator: end-to-end encrypted sync, and works without a Proton account.
    • Google Authenticator: widely used and now offers Google-account backup, which ties your codes to that account; Google says the backup is encrypted in transit and at rest, but not end-to-end, so treat it as less private than the E2EE options above.

    A password manager that also stores TOTP codes is convenient, but it puts your password and your second factor in one place; keep that trade-off in mind for your most sensitive accounts.

  4. Turn it on for the accounts that matter first

    Start with the accounts that protect everything else, in this order: your email (it resets other accounts), your password manager, then banking, cloud storage and primary social accounts. In each account's security settings choose "authenticator app" or "TOTP", scan the QR code with your app, and enter the first 6-digit code to confirm. The site usually shows an option to reveal the secret as text — useful if you want to add it to a second device too.

  5. Save the backup codes before you close the page

    When you enable 2FA, the site offers one-time backup (recovery) codes. Save them now: print them, or store them in your password manager, so a lost phone does not lock you out. Also consider enrolling a second factor on a spare device or a hardware key, so you are never down to a single point of failure. Treat backup codes like a spare key — keep them somewhere only you can reach.

  6. Plan for a new phone

    Before you replace or wipe a phone, move your codes deliberately. If your app syncs (Ente Auth, Proton Authenticator, 2FAS, Google Authenticator), sign in on the new device and confirm the codes appear. If it does not sync (Aegis), export the encrypted backup and import it on the new device. Verify you can log in to one account from the new phone before wiping the old one. This is the step people skip, and it is the one that locks them out.

Common mistakes

  • Using SMS codes when an authenticator app is available; SMS is the one factor a SIM swap defeats.
  • Enabling 2FA and never saving the backup codes, then losing the phone and the account with it.
  • Assuming app codes stop phishing — a fake site can ask for the code and use it immediately; only passkeys resist that.
  • Protecting the social account but not the email that can reset it; secure email first.
  • Keeping the password and the TOTP secret in the same tool for your most sensitive accounts, so one breach exposes both.

Going further

Where a site supports it, replace app codes with a passkey or hardware security key for phishing resistance, and lock down the account-recovery paths that could bypass 2FA (see Hardening account recovery). If your phone number is still a factor anywhere, read Defend against SIM swaps.