Two-factor authentication, or 2FA, is the security feature with the best effort-to-protection ratio in all of computing. It takes half a minute to enable and blocks the overwhelming majority of account-takeover attempts, because even if an attacker has your password, they still cannot get in without the second factor that only you hold.
The idea is simple: logging in requires something you know (your password) plus something you have (your phone, or a small hardware key). Stealing one is common; stealing both at once is hard.
Why not all 2FA is equal
The most common form is a one-time code sent by SMS. It is far better than nothing, but text messages can be intercepted or redirected through "SIM-swap" attacks where a criminal convinces your carrier to move your number to their device. For that reason, an authenticator app that generates codes on your device — offline, with nothing sent over the network — is a meaningful step up.
The strongest option is a hardware security key, a small device you tap or plug in. It is essentially immune to phishing because it verifies the real website cryptographically before responding. For most people, an authenticator app is the sweet spot of security and convenience; for high-value accounts, a hardware key is worth it.
Where to turn it on first
Prioritise by blast radius. Your primary email account comes first, because whoever controls your email can trigger password resets on almost everything else. Then your financial accounts, then any account tied to your identity or work. Most major services now offer 2FA in their security settings; it is usually a few taps to enable.
The one catch to plan for is recovery. When you set up app-based 2FA, save the backup or recovery codes the service gives you somewhere safe and offline, so that a lost phone does not lock you out permanently. Set up the safety net at the same time as the lock.
The habit that makes it effortless
Pair 2FA with a password manager and the daily friction nearly vanishes: the manager fills the password, the authenticator supplies the code, and you are in. The small inconvenience of a second step is trivial next to the cost of an account takeover — the drained account, the stolen identity, the days of cleanup.
If you do only one security thing this week, enabling 2FA on your email is the highest-value candidate. It is the lock on the door that unlocks all your other doors.