Two-factor authentication (2FA)
Last reviewed: July 2026
Two-factor authentication adds an extra layer of security. Even if someone gets your password, they need the second factor to get in.
What is 2FA?
Password → access. Whoever has it, gets in.
Password + code → access. The attacker needs both.
Types of 2FA (from worst to best)
1. SMS (Not recommended) ⚠️
You receive a code by text message.
Problems:
- SIM swapping: Attackers can transfer your number to their SIM
- SMS can be intercepted
- Doesn't require physical access to your phone
Don't use SMS for crypto
SIM swapping is common in attacks on crypto holders. Many people have lost everything by trusting SMS 2FA.
2. Email 2FA (Avoid)
Code sent to your email.
Problems:
- If your email gets hacked, they have both factors
- A single point of failure
3. Authenticator App (Recommended) ✓
Apps that generate temporary codes (TOTP):
| App | Platform | Backup |
|---|---|---|
| Ente Auth | iOS, Android, Desktop, web | End-to-end encrypted |
| 2FAS | iOS, Android | iCloud / Google Drive |
| Aegis | Android | Manual, encrypted |
| Google Authenticator | iOS, Android | Cloud (Google) |
| Microsoft Authenticator | iOS, Android | Cloud (Microsoft) |
Not Authy anymore
Many guides still recommend Authy. Twilio discontinued its desktop apps in 2024. If you're still using it, migrate to one of the ones above.
How it works:
- You scan a QR code when setting it up
- The app generates 6-digit codes
- The codes change every 30 seconds
- Only your device can generate the correct code
4. Hardware Keys (More secure) ✓✓
Physical devices like YubiKey:
You tap it with your finger and that's it. What sets it apart:
- Immune to phishing — it verifies the domain, so on a fake site it simply doesn't work
- Can't be copied remotely — it has to be physically stolen from you
- No battery to run out
| Device | Price | Features |
|---|---|---|
| YubiKey 5 | ~$50 | USB-A/C, NFC |
| YubiKey 5C Nano | ~$55 | Ultra compact |
| Google Titan | ~$30 | USB-A, Bluetooth |
Setting up 2FA with an Authenticator App
Step 1: Install an app
Recommendation: Ente Auth (open source, cross-platform, encrypted backup) or Aegis (open source, Android only).
Step 2: Enable it on the service
On the exchange/service:
- Go to Settings → Security
- Look for "Two-Factor Authentication" or "2FA"
- Select "Authenticator App"
- A QR code will appear
Step 3: Scan the QR code
- Open your authenticator app
- Tap "+" or "Add account"
- Scan the QR code
- The account appears in your app
Step 4: Verify
- The service will ask for the current code
- Enter the 6 digits from your app
- 2FA is now active
Step 5: Save the backup codes
Important
Many services give you backup codes. Store them securely (like your seed phrase). If you lose your phone, they're your only way to recover access.
2FA doesn't protect your wallet
This confuses a lot of people, so it's worth saying clearly:
2FA → protects your ACCOUNT: exchange, email, bank
(something managed by a company with a login)
2FA → has NOTHING to do with your self-custody
wallet (MetaMask, Phantom, Ledger)Your MetaMask doesn't have 2FA and can't have it. There's no server, no account: whoever has your seed phrase has your funds, period. The MetaMask PIN or password only protects that install on that device.
If someone asks you for a 2FA code to "recover your wallet"
It's a scam. No such thing exists. See Spotting scams.
Where to enable 2FA (mandatory)
| Service | Priority | Notes |
|---|---|---|
| Exchanges (Coinbase, Kraken) | 🔴 Critical | Your money is here |
| Primary email | 🔴 Critical | The recovery point for everything |
| Password managers | 🔴 Critical | Holds all your passwords |
| Social media | 🟡 High | To avoid impersonation |
| Banking services | 🟡 High | Your fiat money |
Backing up your 2FA
With encrypted backup (Ente Auth, 2FAS)
- Your codes are backed up to the cloud, encrypted
- Install on a new device and recover everything
Without cloud backup
- Save the QR codes or the secret keys
- Save the backup codes you're given when setting up
- Write them down and store them like your seed phrase
Multiple devices
- Some apps let you have the same 2FA on several devices
- Useful if you lose one
Common mistakes
❌ Only having 2FA on your phone
If you lose or break your phone, you lose access to everything.
Solution: Use an app with encrypted backup (Ente Auth, 2FAS), or save the recovery codes on paper.
❌ Trusting SMS
We already explained why it's dangerous.
Solution: Switch to an authenticator app.
❌ Not saving backup codes
"I'll set it up later..."
Solution: Save the backup codes IMMEDIATELY when you set it up.
❌ Same email for everything
If your email is compromised, they can recover access to everything.
Solution: Use a separate email for critical crypto services, with its own 2FA.
Summary
- 2FA adds a critical layer of security
- Never use SMS for crypto
- An authenticator app (Authy, Aegis) is the minimum
- Hardware keys (YubiKey) are the most secure option
- Always save backup codes
- Enable 2FA on exchanges, email, and critical services
If you came looking for something else:I'm about to receive crypto · I want to cash out to local currency · Start from the beginning