Two-Factor Authentication (2FA): What It Is and Why It Matters
Two-factor authentication adds a second lock to your account: something you have (a phone or a key) on top of something you know (your password). A stolen password alone is then no longer enough to get in.
Not all methods are equally strong
A hardware security key is the strongest option and defeats phishing outright. An authenticator app (TOTP) is a very good second. SMS codes are better than nothing, but they can be intercepted through SIM-swap fraud — use them only when nothing else is offered.
Save your recovery codes
When you enable 2FA you are given one-time recovery codes. Store them in your password manager or on paper in a safe place — they are what stands between you and a locked-out account the day the phone is lost.
2FA does not replace the password
The two factors guard different flanks: 2FA stops a leaked password from becoming a takeover, while a strong unique password protects you where 2FA is unavailable or bypassed. You need both.
Which popular services support 2FA?
| Service | Supported methods |
|---|---|
| Discord | SMS, authenticator app (TOTP), hardware security key |
| Duolingo | No 2FA offered — the password is the account’s only lock |
| EA (Electronic Arts) | SMS, email, phone call, authenticator app (TOTP) |
| Epic Games | SMS, email, authenticator app (TOTP), the service’s own app |
| SMS, authenticator app (TOTP), hardware security key | |
| Fortnite | SMS, email, authenticator app (TOTP), the service’s own app |
| iCloud Mail | SMS, phone call, hardware security key, the service’s own app |
| SMS, authenticator app (TOTP) | |
| Minecraft | SMS, phone call, email, authenticator app (TOTP), the service’s own app |
| Netflix | No 2FA offered — the password is the account’s only lock |
| PayPal | authenticator app (TOTP), hardware security key |
| PlayStation | SMS, authenticator app (TOTP) |
| Roblox | authenticator app (TOTP), email, hardware security key |
| Snapchat | SMS, authenticator app (TOTP) |
| Spotify | No 2FA offered — the password is the account’s only lock |
| Steam | email, the service’s own app |
| Telegram | SMS, phone call |
| TikTok | authenticator app (TOTP), SMS, email |
| Ubisoft | email, authenticator app (TOTP), SMS |
| X (Twitter) | SMS, authenticator app (TOTP), hardware security key |
| YouTube | SMS, phone call, authenticator app (TOTP), the service’s own app, hardware security key |
Source: the community-maintained 2fa.directory. Offerings change — check the service’s security settings.
Security Guides
How Long Should a Password Be?
How password length affects cracking time — real numbers per length and character set, plus recommendations for accounts, email and master passwords.
The Most Common Password Mistakes
Six password mistakes attackers exploit every day — reuse, personal details, keyboard patterns, l33t substitutions, short passwords and unsafe storage — and what to do instead.
Two-Factor Authentication (2FA): What It Is and Why It Matters
How two-factor authentication works, which method to choose — security key, authenticator app or SMS — and which major services support it.
Do You Need a Password Manager?
Why a password manager is the only realistic way to keep a unique, random password for every account — and how to protect the vault itself.
Data Breaches: What Happens to Your Passwords When a Service Is Hacked
Breach, scrape or credential stuffing? What each incident type means for your passwords, documented incidents at major services, and what to do when it happens.