I Almost Got Hacked — Here's How Two-Factor Authentication Saved My Accounts

Not all 2FA is created equal. Match the method to your risk level and device situation.

1. 1
   Use a hardware security key for high-value accounts — YubiKey or Google Titan keys are physical devices you plug in or tap. They're phishing-resistant because the key only works on the real site. Use them for email, password managers, and work accounts.
2. 2
   Install an authenticator app for most accounts — Google Authenticator, Microsoft Authenticator, or Authy generate time-based codes offline. They're free and work without cell service. Authy is best if you switch phones often — it syncs across devices.
3. 3
   Only use SMS as a last resort — SMS codes can be intercepted via SIM swapping or SS7 attacks. If SMS is the only option your bank offers, enable it — but also set up a PIN or call-back verification if available.
4. 4
   Enable biometric 2FA on your phone — Face ID, Touch ID, or Windows Hello count as 2FA when combined with a password. Use them for quick unlocks on your phone, but don't rely on them alone for critical accounts.
5. 5
   Generate backup codes and store them safely — Every service gives you 8–10 one-time backup codes when you enable 2FA. Print them and keep them in a safe place — your wallet, a safe, or a locked drawer. Without them, you'll be locked out if you lose your phone.

Your password manager holds the keys to your kingdom — protect it with a hardware key or authenticator app.

1. 1
   Log into your password manager — Open Bitwarden, 1Password, or LastPass. Go to Account Settings → Security → Two-Factor Authentication.
2. 2
   Choose a 2FA method — If you have a YubiKey, use FIDO2 or WebAuthn. If not, use an authenticator app. Avoid SMS for this account.
3. 3
   Scan the QR code with your authenticator app — Open Authy or Google Authenticator, tap 'Add account', and scan the QR code on your password manager's setup page.
4. 4
   Enter the 6-digit code to confirm — Type the code from your app into the confirmation field. The code changes every 30 seconds, so do this quickly.
5. 5
   Save your backup codes — Copy the backup codes provided by your password manager. Store them in a safe place — not inside the password manager itself, since you'll be locked out.

A single app can hold 2FA codes for dozens of accounts, making it easy to log in without SMS.

1. 1
   Download an authenticator app — Get Authy (iOS/Android/Desktop), Google Authenticator, or Microsoft Authenticator. Authy is best for multi-device sync.
2. 2
   Enable 2FA on your first account — Go to any account's security settings, select 'Authenticator app', and scan the QR code with your app.
3. 3
   Add all your accounts to the same app — Repeat the process for email, social media, banking, and any other account that supports authenticator apps. Most services let you add multiple 2FA methods — keep your old method until the new one works.
4. 4
   Set up app lock on your phone — In Authy, enable 'App PIN' or 'Biometric unlock'. This prevents someone from opening your 2FA codes even if they unlock your phone.
5. 5
   Enable cloud backup (if available) — Authy backs up your codes to their cloud (encrypted with your backup password). Google Authenticator now offers Google Account sync. This saves you if you lose your phone.

Hardware keys like YubiKey are the gold standard — they can't be phished and work across hundreds of services.

1. 1
   Buy a hardware key — Get a YubiKey 5 NFC or Google Titan Key. The NFC version works with both USB and tap-to-phone (Android and iPhone with Lightning adapter).
2. 2
   Register the key with your Google account — Go to myaccount.google.com → Security → 2-Step Verification → Add security key. Insert the key into your USB port or tap it on your phone's NFC reader.
3. 3
   Add the key to your password manager — In Bitwarden or 1Password, go to Security → Two-Factor Authentication → FIDO2 WebAuthn. Follow the prompts to register your key.
4. 4
   Set up the key on Facebook and Twitter — Facebook: Settings & Privacy → Security and Login → Use two-factor authentication → Security Key. Twitter: Settings → Security → Two-factor authentication → Security Key.
5. 5
   Buy a second key as a backup — Register a second key to your accounts and store it in a safe place. If you lose your main key, you'll still have access.

Locking yourself out is the #1 fear with 2FA. Here's how to avoid it.

1. 1
   Print your backup codes — Every service gives you 8–10 one-time codes when you enable 2FA. Print them and keep them in your wallet and a safe. Also take a photo and store it in a locked notes app.
2. 2
   Set up a secondary 2FA method — Add a second authenticator app or a backup phone number. For example, use both Authy and a hardware key. If one fails, the other works.
3. 3
   Use a recovery service like Google's — Google lets you set up recovery phone and email. If you lose your 2FA, they'll send a code to your backup email or phone. Do this for every service that offers it.
4. 4
   Store a spare hardware key off-site — Give a second YubiKey to a trusted family member or keep it in a safe deposit box. Label it clearly so they know what it is.
5. 5
   Test your recovery process — Once a year, try to log into an account using only your backup codes or spare key. If it doesn't work, fix it before you actually need it.