Two-factor authentication: set it up today, with a free app you control

Two-factor authentication means signing in with your password plus something only you hold, usually a code from an app on your phone. It stops most attacks that rely on a stolen or guessed password, which is how many account takeovers start. Set it up first on your email, then on your banking, hosting and business accounts. Use a free, open-source authenticator app rather than SMS codes where you can, and save your backup codes somewhere safe so a lost phone never locks you out. This article explains each step.

What two-factor authentication does

A password is something you know, and it can be stolen, guessed or leaked from another website. Two-factor authentication adds something you have, such as your phone or a security key. A criminal with your password still cannot sign in without it.

The evidence is strong. A 2023 Microsoft study of business accounts found that using multi-factor authentication reduced the risk of compromise by 99.22%, and that dedicated authenticator apps did better than SMS codes. Google's 2019 research found that even a simple SMS code to a recovery phone blocked all automated bot attacks on the accounts it studied, and that people who relied on security keys suffered no successful targeted phishing at all.

The UK National Cyber Security Centre (NCSC) and the US cybersecurity agency CISA agree on the starting point: any form of two-factor authentication is better than none.

Start with the accounts that matter

Not every account needs it today. These do:

1. Your email. Whoever controls your email can reset the password of almost everything else, so the NCSC puts it first.
2. Banking and payments.
3. Your hosting control panel, where you manage your websites and mail.
4. Your domain registrar, if your domains are held elsewhere.
5. Your website's admin accounts, such as WordPress administrators.
6. Social media and any account that speaks for your business.

Choose your second step

Not all second steps are equal. CISA ranks them, from strongest to weakest:

Where a service offers passkeys, use them; the NCSC now says they should generally be used where available. For everything else, an authenticator app is the practical choice.

Why SMS codes are the weakest

SMS codes depend on your phone number, and a phone number can be taken from you. In a SIM swap, a criminal persuades your mobile network to move your number to a SIM card they control. From then on, your text messages, including login and banking codes, go to them. It happens worldwide. In South Africa, the banking industry's risk centre SABRIC warns that criminals swap or port numbers to receive bank one-time PINs.

SABRIC's warning signs are worth knowing:

• Your phone suddenly loses signal where it normally has it. Contact your network immediately, then your bank.
• You receive a one-time PIN you did not ask for. Someone may be using your details.
• Someone asks you to read a PIN back to them. Never do it, whoever they say they are.

An authenticator app removes your phone number from the picture. SMS codes are still far better than no second step, so use them where nothing else is offered.

Free, open-source authenticator apps

Most authenticator apps use the same open standard, TOTP, so any of them works with any service that shows a QR code. We recommend free, open-source apps that keep your codes under your control:

A word on password managers. KeePassXC and Bitwarden can both store your two-factor codes. KeePassXC's own guide warns that keeping the codes in the same database as the passwords removes the benefit of two-factor authentication, because one stolen database then holds both factors. If you use a password manager for codes, keep them in a separate database or app.

Set it up in five minutes

The steps are almost the same on every service:

1. Open the account's security settings and look for two-factor authentication, two-step verification or multi-factor authentication.
2. Choose "authenticator app" and scan the QR code with your app.
3. Type the six-digit code the app shows to confirm.
4. Save the backup codes the service gives you (see below).
5. Test it. Sign out, or open a private browser window, and sign in again with your password and a code.

Treat the QR code like a password: it contains the secret your app uses to make codes, and anyone who has it can make the same codes. Do not email it, paste it into a ticket or leave a screenshot of it on your phone.

Backup codes and a lost phone

When you turn on two-factor authentication, most services give you a set of backup codes. Each works once, and they let you in if your phone is lost, broken or stolen.

• Store them offline, printed or written down, as NIST's guidelines suggest, or in a password manager that is not on the same phone as your authenticator.
• Set up a second method where the service allows it, such as a second device or a security key.
• Back up your authenticator app itself, using its encrypted backup feature.

This matters more than people expect. GitHub, for example, says plainly that its support team cannot restore access to an account if you lose both your two-factor device and your recovery codes. Many services work the same way.

What two-factor authentication does not stop

Two-factor authentication protects the moment you sign in. It does not protect a session that has already been stolen from your browser by malware, and codes from apps and SMS can still be phished by a convincing fake login page. Our article on infostealer malware explains both, and why passkeys are the next step.

Two-factor sign-in on Noiz services

• The Plesk control panel. Our help article shows how to enable two-factor authentication in Plesk.
• WordPress. See two-factor authentication in WordPress.
• Email. Private Email, our managed Mailcow service, includes two-factor authentication for your users.

Turn it on for your email today, and for your hosting control panel straight after. If you get stuck, get in touch.

Sources

Checked 19 October 2026.

Research and statistics

• Microsoft Research, How effective is multifactor authentication at deterring cyberattacks? (2023)
• Google Security Blog, How effective is basic account hygiene at preventing hijacking (2019)

Government guidance and standards

• CISA, Implementing phishing-resistant MFA (PDF)
• CISA, Implementing number matching in MFA applications (PDF)
• NCSC, Setting up 2-step verification
• NCSC, Small organisations guide: secure your important online accounts
• NCSC, Activate 2-step verification on your email
• NCSC, Passkeys are more secure than traditional ways to log in (April 2026)
• NIST SP 800-63B-4, Authentication and authenticator management
• RFC 6238, TOTP
• SABRIC, How to stay safe

Apps and services

• Aegis Authenticator
• Ente Auth
• 2FAS
• KeePassXC user guide
• Google, Sign in with backup codes
• GitHub, Recovering your account if you lose your 2FA credentials

Noiz

• Private Email
• Help articles linked in the text, on docs.noiz.ie

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.