Is 2FA really necessary? What a second factor actually stops

"My password is long and unique — do I really need two-factor authentication on top?" It's a fair question. The short answer is yes, because 2FA protects against threats a strong password simply can't touch.

What a strong password does — and doesn't — do

A long, unique password protects you from guessing and from password reuse. It does nothing once the password itself is exposed. And passwords get exposed all the time, through no fault of yours:

• Data breaches. A service you use gets hacked and its password database leaks. Even a perfect password is now public.
• Phishing. You're tricked into typing it into a fake page.
• Malware or a shoulder-surfer captures it as you type.

In every one of these, the attacker ends up with your correct password. A second factor is what stops them from getting in anyway.

What the second factor adds

With an authenticator app enabled, logging in needs something you know (the password) and something you have (your phone generating a TOTP code). An attacker on the other side of the world has the first but not the second — so the login fails.

Where it matters most

You don't need it on everything at once. Start where the damage would be worst:

• Your email — the master key to the rest.
• Your bank and crypto accounts.
• Your social and gaming accounts.

Turning it on takes about a minute per account, and it's the biggest security upgrade most people can make. Browse setup guides →