Which kind of two-step sign-in is best?
Reviewed answer
Passkeys or a security key are best, then an authenticator app. Text codes still beat nothing.
- Turn on two-step sign-in for email, banking, and your Apple, Google, or Microsoft account first. Look in each account's security settings.
- If a passkey is offered, use it. It already counts as strong two-step protection.
- Otherwise pick an authenticator app (Google Authenticator, Microsoft Authenticator, or the codes built into Apple's Passwords app) over text messages.
- Save the backup codes the site gives you. Print them or keep them in your password manager.
- Never read a sign-in code to anyone who calls or texts you. Real companies don't ask for it.
Get help if
If you get a sign-in code or approval prompt you didn't ask for, someone has your password. Deny it and change that password now.
More in the phone and mac kit.