HaveIBeenPwned, the breach tracking site, has catalogued over 14 billion compromised accounts. That number is not a projection. It’s already in the database.
Most people reuse passwords across accounts. When a small e-commerce site you signed up for in 2016 gets breached, attackers don’t just try that password on that site. They run it against Gmail, your bank, PayPal, LinkedIn, and Amazon, automatically, across millions of accounts, around the clock. This is credential stuffing, and it works because passwords alone are easy to collect and easy to reuse.
Two-factor authentication breaks this attack completely. Even if attackers have your exact password, they can’t get in without a second factor that only you have.
The problem is that not all 2FA is equal. Some methods are genuinely strong. Some can be bypassed in under an hour by a motivated attacker. This guide explains exactly which type to use for which account, and how to set it up on the services that matter most.
How 2FA works
The logic behind two-factor authentication is simple: a lock with two keys is harder to pick than one with one.
Your password is something you know. The second factor is something you have: your phone, a physical key, or a device that generates time-sensitive codes. An attacker who steals your password from a breach database doesn’t have your physical device, so the lock stays closed.
There are three types of second factors, ordered from weakest to strongest.
SMS codes. A 6-digit code sent to your phone by text message. Easy to set up, works on any phone. The weakness: your phone number can be hijacked. Attackers call your mobile carrier, claim to be you, and convince a customer service rep to transfer your number to their SIM card. All texts then route to them. This is called a SIM swap attack, and carriers’ identity verification is often shockingly easy to bypass.
Authenticator apps. Apps like Aegis, Authy, or Google Authenticator generate TOTP (Time-based One-Time Password) codes offline. These codes change every 30 seconds and are tied to a secret key stored on your device, not to your phone number. No SIM swap can touch them. A determined attacker with a real-time phishing page can still capture a code if you type it in fast enough. But this is a targeted attack, not the automated credential stuffing that hits millions of accounts at once.
Hardware security keys. Physical USB or NFC devices (YubiKey, Google Titan) that you plug in or tap to your phone. They use a protocol called FIDO2/WebAuthn that cryptographically verifies the website’s actual domain before authenticating. A phishing page at “g00gle.com” won’t work, because the key checks the domain and refuses. This is the only 2FA method that is effectively phishing-proof. Passkeys use the same cryptography and go a step further by replacing the password too.
Which type to use for which account
Not every account needs a hardware key. Here’s the practical breakdown.
Email accounts (Gmail, Outlook, Apple ID). At minimum, use an authenticator app. Your email is the recovery account for everything else. If someone gets into your Gmail, they can reset your bank password, your PayPal, your crypto exchange. Treat it like the master key to your life. If you can afford a hardware key, use it here first.
Financial accounts (banking, brokerage, PayPal). Authenticator app or hardware key. Many banks only offer SMS 2FA. Use it if that’s all they offer, because SMS 2FA is still far better than no 2FA. But push for TOTP wherever the option exists. Strong 2FA here is a direct defence against account takeover fraud.
Social media (Facebook, Instagram, X/Twitter). Authenticator app. These are high-value targets for account takeover scams. Hijacked social accounts get used to run fraudulent ads, scam your followers, and impersonate you.
Work accounts. Follow your IT department’s requirements, but advocate for authenticator apps over SMS. Corporate accounts are prime targets for phishing campaigns.
Everything else. For retail sites, newsletter subscriptions, and low-value accounts, SMS 2FA is fine. The damage from a compromised account here is limited.
The best authenticator apps
These are real assessments, not marketing copy.
Aegis (Android, free, open source). The best option for Android users. Codes are stored in an encrypted local database. Backup is manual: you export an encrypted file and store it yourself. There is no cloud sync that can be compromised by someone breaking into a server. Highly recommended for anyone who takes security seriously.
2FAS (iOS and Android, free, open source). Free, open source, available on iOS and Android, with an active development team and no proprietary backend. Local encrypted storage, manual backup, no account required. Best choice for iOS users.
Authy. Available on Android, iOS, and desktop. Solid backup features with cloud sync, which is genuinely useful if you switch phones often. The tradeoff: your TOTP codes are stored in Authy’s cloud. If your Authy account is compromised, every 2FA code you have is exposed. Used by tens of millions of people for a reason, because the convenience is real. Note: in 2024, Authy’s parent company Twilio suffered a breach exposing user phone numbers, and the desktop app was discontinued. Consider 2FAS or Aegis as alternatives.
Google Authenticator. Added encrypted backup in 2023, tied to your Google account. Simpler than Authy. If your Google account is already your main email, this adds a dependency you may not want.
1Password / Bitwarden (built-in TOTP). Convenient, but think carefully. Storing your password and your 2FA code in the same app means that if the app’s master password is compromised, both factors are gone. This partly defeats the purpose of two-factor authentication.
The recommendation: Aegis on Android, 2FAS on iOS for anyone who prioritizes security. Authy for ease of use and multi-device access, accepting the cloud sync tradeoff.
Hardware security keys: when you need one
A hardware security key is a small physical device, about the size of a USB thumb drive, that you register with your accounts. When you log in, you plug it in or tap it to your phone’s NFC reader, and it cryptographically signs the login request.
The critical feature is domain verification. The FIDO2/WebAuthn protocol bakes the website’s actual domain into the cryptographic exchange. If you’re logging into google.com, the key verifies that’s where you actually are. A fake login page at “g00gle.com” or “google.com.login.malicious.net” fails the check. The key won’t authenticate to the wrong site, full stop.
Popular options: YubiKey 5C NFC ($55, works with USB-C and NFC-capable phones), Google Titan Security Key ($30, available in USB-A/C and NFC versions), SoloKey ($20–$50, open source hardware).
Who actually needs one? Journalists handling sensitive sources. Political activists in countries with authoritarian surveillance. Executives with access to high-value corporate accounts. Anyone who has already been targeted by a phishing attack. If you’ve ever received a sophisticated, targeted phishing attempt, one that used your real name, knew your employer, or mimicked a service you actually use, a hardware key is worth the cost.
For most people, a strong authenticator app covers the realistic threat. Hardware keys are for elevated-risk individuals or anyone who wants the strongest possible protection on their most important accounts (email, especially).
How to set up 2FA on the accounts that matter most
Google / Gmail
- Go to myaccount.google.com
- Select Security from the left sidebar
- Under “How you sign in to Google,” click 2-Step Verification
- Click Get started and follow the prompts
- Choose Authenticator app, then scan the QR code with Aegis or 2FAS
- Save your backup codes before you finish (10 single-use codes; download and store them)
Apple ID
- Open Settings on your iPhone
- Tap your name at the top, then Sign-In & Security
- Tap Turn On Two-Factor Authentication
- Apple uses its own push-based system tied to your Apple devices; follow the on-screen steps
- You’ll also set a trusted phone number as a fallback. Make sure it’s a number you actually control
Facebook / Instagram
- Facebook: Go to Settings & Privacy → Settings → Accounts Center → Password and security → Two-factor authentication
- Instagram: Go to Settings → Accounts Center → Password and security → Two-factor authentication
- Select your account, then choose Authentication app
- Scan the QR code with your authenticator app
- Save the recovery codes Facebook/Instagram provides
- Open WhatsApp, tap the three dots (Android) or Settings (iOS)
- Go to Account → Two-step verification → Enable
- Create a 6-digit PIN. This is what WhatsApp calls 2FA (it’s different from TOTP; it’s a PIN required when re-registering your number on a new device)
- Add a recovery email address
- Store the PIN somewhere safe. You’ll need it if you reinstall WhatsApp
Backup codes: the thing everyone forgets
Every major service gives you emergency backup codes when you enable 2FA. These are typically 10 single-use codes that let you log in if you lose your phone.
Most people skip past this step. Don’t.
Say you lose your phone, break it, or get a new one before migrating your authenticator app, and you didn’t save your backup codes. You can be permanently locked out of your account. Account recovery without backup codes is a slow, uncertain process. Some services require weeks of identity verification. Some don’t recover accounts at all.
Save backup codes in at least one physical form: printed and stored somewhere secure (a locked drawer, a home safe), or written in a notebook. You can also store them in an encrypted notes app on a device you don’t use as your primary phone. The point is: separate from the phone that runs your authenticator app.
The SIM swap risk with SMS 2FA
If your 2FA method is SMS codes, here’s the specific attack you’re exposed to.
An attacker calls your mobile carrier’s customer support line. They claim to be you, using personal information gathered from data broker sites, social media, or previous breaches. They say they just got a new SIM and need to transfer their number. The customer service rep, following an inadequate verification process, transfers your phone number to a SIM card the attacker controls.
From that moment, every SMS 2FA code goes to the attacker. They request a password reset on your email, get the SMS code, log in, and lock you out, often within minutes.
This isn’t a theoretical attack. It has been used to drain cryptocurrency accounts, compromise Twitter/X accounts, and access banking services. High-profile targets have lost millions this way.
Switching to an authenticator app eliminates this risk entirely. Your TOTP codes are generated locally on your device, tied to a cryptographic secret, not to your phone number. There’s nothing a carrier rep can hand over.
For a full breakdown of how SIM swap attacks work and how to protect your number, see our guide at /blog/sim-swap-attacks/.
Setting it up: the right order
If you’re starting from zero, do this in order:
- Download an authenticator app first. Aegis (Android) or 2FAS (iOS). Get familiar with it before you start enabling 2FA everywhere.
- Secure your email account. Gmail, Outlook, or Apple ID. This is the recovery account for everything else. Enable 2FA, save backup codes, store them somewhere physical.
- Secure your financial accounts. Bank, brokerage, PayPal, and any crypto exchanges. Enable the strongest 2FA the service offers.
- Secure social media. Facebook, Instagram, X/Twitter.
- Enable 2FA on everything else. Any account that matters, in order of how bad it would be to lose access.
One account at a time. Don’t rush through it. The backup codes step is not optional: treat it as part of enabling 2FA, not an afterthought.
Your password is already in a breach database somewhere. That’s not pessimism; that’s probability, given 14 billion compromised credentials and counting. Two-factor authentication is the layer that makes a leaked password useless. The method matters, but using any authenticator app on your most important accounts puts you significantly ahead of where you are with a password alone.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.