What Is Two-Factor Authentication (2FA)? How to Turn It On
What is 2FA and how does it work? SMS, authenticator apps and passkeys compared, backup codes, 2FA for SSH and how to keep your accounts secure.
Two-factor authentication (2FA) means you're asked for a second proof in addition to your password when you sign in to an account; usually a 6-digit code generated by an app on your phone. Even if your password shows up in a data breach or you hand it over to a phishing site, someone who doesn't have the second factor can't get into your account. Today it's one of the most effective steps you can take against account takeovers.
This guide covers how 2FA works, the differences between the methods, why backup codes matter, which accounts to turn it on for and how to set up 2FA for SSH logins on your own server.
What does two-factor mean?
There are three types of proof in authentication:
- Something you know: A password or PIN.
- Something you have: Your phone, a security key.
- Something you are: A fingerprint, face recognition.
2FA combines two different types of these. Asking for two separate passwords isn't 2FA; both are "something you know" and can be stolen the same way.
2FA methods
| Method | How it works | Security |
|---|---|---|
| SMS code | A code is sent to your phone number | Basic |
| Email code | A code is sent to your email address | As good as your email |
| Authenticator app (TOTP) | The app generates a new code every 30 seconds | Good |
| Push approval | You approve a notification sent to your phone | Good |
| Security key and passkey | A physical key or an encrypted key on your device | Highest |
SMS is much better than no 2FA at all, but your phone number can be transferred to someone else through SIM swap fraud. Authenticator apps don't need an internet connection and are a good balance for most people. Security keys and passkeys only respond to the real site, so they also protect you against phishing sites.
How do authenticator apps work?
Authenticator apps use the TOTP (Time-based One-Time Password) standard:
- When you turn on 2FA, the site shows you a QR code. This code contains a secret key shared between the site and your app.
- The app uses this key and the current time to generate a new code every 30 seconds.
- When you sign in, the site does the same calculation on its side and compares the codes.
Because the codes are based on the time, your phone's clock needs to be correct; keep automatic date and time turned on in your phone's settings. We explain why the clock matters on servers in our Linux timezone and NTP guide.
Google Authenticator, Microsoft Authenticator, 1Password, Authy and similar apps all work with the same standard.
Keep your backup codes
When you turn on 2FA, most sites give you a set of backup codes (recovery codes). If you lose your phone or delete the app, you sign in to your account with these codes.
- Keep your backup codes in a password manager, or print them and store them somewhere safe.
- Each code can usually be used only once; generate new ones when you're running low.
- If your authenticator app has a backup or cross-device transfer feature, turn it on. When you move to a new phone, don't reset the old one before moving your accounts.
Which accounts should you turn it on for?
In order of priority:
- Your email account: Password reset links for all your other accounts go here.
- Your domain and hosting provider: With a compromised account, your DNS records, your site and your email can be changed.
- Your server and game panel accounts.
- Code repositories such as GitHub and GitLab: In projects that deploy to a server automatically, repository access means server access; the details are in our How to deploy with Git guide.
- Discord and community management accounts.
- Banking and payment accounts.
Use a 2FA plugin for the admin accounts of sites such as WordPress too; the details are in our How to install WordPress guide.
2FA for SSH on your server
On your own server, the strongest protection is to turn off password login and sign in only with an SSH key; we cover this in our What is SSH? article. If you want an extra layer, you can also ask for a TOTP code alongside the SSH key. On Ubuntu and Debian:
sudo apt install libpam-google-authenticator
google-authenticator
Run the second command as the user you'll sign in with (without sudo). The command shows a QR code and backup codes; scan the QR code with your authenticator app and keep the backup codes. Then add this line to the end of the /etc/pam.d/sshd file, and put a # in front of the @include common-auth line so you aren't asked for a password:
auth required pam_google_authenticator.so
Set the following in the /etc/ssh/sshd_config file:
KbdInteractiveAuthentication yes
UsePAM yes
AuthenticationMethods publickey,keyboard-interactive
On older releases such as Debian 11, the first setting is called ChallengeResponseAuthentication. Restart the SSH service:
sudo systemctl restart ssh
Without closing your current SSH session, try signing in from a new terminal. Your key is used first, then you're asked for the verification code. If something goes wrong, you can undo the settings from the open session. If you can't reach the server at all, the web console in your provider's panel is the last resort. We've collected the other server security steps in our Linux server security checklist.
Watch out for attempts to get around 2FA
2FA is strong, but attackers try to get the code from you:
- Don't share your code with anyone. A real support team won't ask for your sign-in code.
- Reject approval notifications you aren't expecting. A notification that arrives when you aren't signing in means someone else has your password; change your password right away.
- Check the address of the sign-in page. Phishing sites can ask for your verification code along with your password and use it instantly.
2FA on your Nodesty account
In the Nodesty customer panel, you can turn on two-factor authentication and add a passkey from your account's security page; 2FA works with Google Authenticator, 1Password, Authy and similar authenticator apps. In the panel, you also get security notifications for new sign-ins and for password, two-factor authentication and access changes.
On AMD Ryzen 9 9950X VPS and AMD EPYC 7763 VPS plans, you have full root access to set up 2FA for SSH as described in this guide, and you can connect to your server from the panel's web console if you lose access. On web hosting plans, protect your site's admin accounts with 2FA as well.
Frequently Asked Questions
What happens if I lose my phone after turning on 2FA?
You can sign in with one of the backup codes you were given when you turned on 2FA, which is why it's important to keep those codes somewhere safe. If you don't have your backup codes either, you'll need to go through your service provider's account recovery process, which can take time while they verify your identity.
Is SMS verification secure?
SMS is much better than no 2FA at all, but it's the weakest method. A phone number can be transferred to someone else through SIM swap fraud, and phishing sites can easily ask for SMS codes. If you have the option, use an authenticator app or a security key.
Why isn't my verification code accepted?
The codes in authenticator apps are generated based on the time. If your phone's clock isn't set automatically, the codes will be wrong; turn on automatic date and time on your phone. Try to enter a code right after it's generated, not when it's about to expire.
Are passkeys and 2FA the same thing?
Not exactly. A passkey is a sign-in method that replaces your password; it uses a key stored on your device together with your fingerprint, face recognition or device PIN. Because it combines something you have with something you know or something you are, it gives you two-factor security in a single step and resists phishing.
Which accounts should I turn on 2FA for?
Start with your email account, since password resets for your other accounts go there. Then turn it on for your domain and hosting provider, your server and game panel accounts, code repositories such as GitHub, community management accounts such as Discord, and your banking and payment accounts.
Which authenticator app should I use?
Google Authenticator, Microsoft Authenticator, 1Password, Authy and similar apps all work with the same standard. Choosing an app that lets you back up your accounts or move them to a new phone keeps you from losing access when you change phones.
About the author
Nodesty Team · Infrastructure & Support
The Nodesty team runs our servers, network and DDoS protection day to day and answers customer support requests around the clock. These guides come from that work.
Related articles
How to Use UFW: An Ubuntu Firewall Guide
How to use UFW on Ubuntu: enabling the firewall safely, port and IP rules, deleting rules, application profiles, rate limiting, IPv6 and Docker.
HTTP Security Headers: HSTS, CSP and More
What are HTTP security headers? HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, adding them with Nginx and .htaccess, and testing.
What Is an SSH Tunnel? A Port Forwarding Guide
What is an SSH tunnel and how do you set one up? Local, remote and dynamic port forwarding, secure database and panel access, ~/.ssh/config and autossh.