What is two-step verification, and do you need it?
In short
- Two-step verification asks for a second proof after your password, so a stolen password alone isn’t enough.
- The second step can be a text code, an authenticator app, a security key or a passkey.
- The NCSC says any 2SV is better than none; start with your email, since it can reset everything else.
Two-step verification (2SV), also called two-factor authentication (2FA), adds a second check after your password.
How it works
You sign in with your password, then prove it’s you a second way. If someone steals your password, they still can’t get in without that second step.
The second step
- A code by text: simple, but the weakest. See text codes vs authenticator apps.
- An authenticator app: makes codes on your phone, with no signal needed.
- A security key or passkey: the strongest, and what the NCSC now recommends wherever it’s offered.
Do you need it?
The UK’s National Cyber Security Centre says any 2-step verification is better than none. Start with your email account, since it can reset the passwords for everything else, then banking, shopping and social media.
Keep a way back in
Save backup codes when you turn it on. See backup and recovery codes.
Common questions
Is two-step verification the same as two-factor authentication?
Yes, near enough. Both mean a second check after your password.
Which second step is safest?
Passkeys and security keys, then authenticator apps. Text codes are the weakest, though the NCSC says any 2SV beats none.
Which account should I protect first?
Your email, since it can reset the passwords for your other accounts.