{{img:hero}}Two-factor authentication (2FA) sounds scary, but it’s basically a “spare key” rule: even if someone steals your password (your first key), they still need a second thing to get in.

Most confusion comes from assuming that second thing is always equally strong. It isn’t.

Myth #1: “2FA means my account can’t be hacked.”

Reality: 2FA mostly protects you from password theft and password reuse. It doesn’t make an account invincible.

Think of it like adding a deadbolt. Great upgrade, but if you hand someone the keys, or they trick you into opening the door, the deadbolt doesn’t help.

Where 2FA can still fail: convincing phishing pages, SIM-swaps (for SMS codes), malware that steals session cookies, or approving a login you didn’t start.

Myth #2: “A text message code is the same as an authenticator code.”

Reality: SMS is better than nothing, but it’s usually the weakest 2FA option.

{{img:sms-vs-app}}SMS codes can be intercepted or rerouted (SIM swap), and they depend on your phone number staying safely attached to you. Authenticator apps generate codes on-device, which removes the phone carrier from the chain.

If you have a choice on iPhone: prefer an authenticator app or passkeys over SMS.

Myth #3: “Biometrics (Face ID/Touch ID) is 2FA.”

Reality: Face ID/Touch ID is usually a way to unlock something you already have on your phone (like your password manager or authenticator app). That’s useful, but it’s not automatically “two factors” for your online account.

In the “spare key” analogy, biometrics is more like how you open your keyring—fast and convenient—rather than an extra lock on the building.

Myth #4: “Passkeys are just another password.”

Reality: Passkeys are designed to resist phishing because they’re tied to the real site/app you’re logging into.

{{img:passkeys-metaphor}}A simple way to picture it: a password is something you can accidentally type into the wrong door. A passkey is more like a key that only fits one specific lock, and refuses to work on a fake copy.

On iOS, passkeys are typically stored in iCloud Keychain and unlocked with Face ID/Touch ID and your device passcode.

Myth #5: “Authenticator apps are risky because they ‘live on my phone’.”

Reality: The main risk isn’t “being on your phone.” The risk is not having a recovery plan if you lose access to that phone.

Many people set up an authenticator and stop there—then later get locked out after a phone upgrade, loss, or reset.

What to do instead: treat setup like you’re making a spare house key and deciding where it’s stored.

A calm setup checklist (so future-you doesn’t get locked out)

Use this as a quick “done is safe” list when you turn on 2FA for any account.

  • Prefer passkeys or an authenticator app when the service offers them.
  • Save backup/recovery codes somewhere you can still reach if your phone is gone (password manager, printed copy in a safe place).
  • Add a second recovery method if possible (secondary device, security key, or trusted phone number as a last resort).
  • Check your account’s “trusted devices” list and remove anything you don’t recognize.
  • Turn on login alerts (email/push) so you hear about suspicious sign-ins quickly.
  • Never approve a push prompt you didn’t initiate—treat it like someone ringing your doorbell at 2 a.m.

Takeaway: pick the “second key” that matches your risk

{{img:checklist-cards}}If you remember one thing, make it this: 2FA is a great upgrade, but not all second factors are equal.

On iPhone, a good beginner default is passkeys where available, otherwise an authenticator app, with recovery codes saved. SMS is okay when it’s the only option—just don’t confuse it for the strongest lock.