Password Managers and Two-Factor Authentication Explained

Password managers and two-factor authentication are the two most effective steps most people can take to protect their online accounts. Together, they solve the biggest security problems: weak passwords, reused passwords and stolen passwords. Neither requires technical skill, and once they’re set up, they make signing in easier rather than harder.

Why passwords alone aren’t enough

The average person has dozens, often hundreds, of online accounts. Nobody can remember a unique, strong password for each one, so most people fall back on patterns: a favorite word with a number, the same password everywhere, or small variations of one base password.

That creates three common risks:

• Reuse. When one website suffers a data breach, criminals try the leaked email and password combinations on other popular sites. If you reuse passwords, one breach can unlock many accounts.
• Guessable passwords. Short passwords or ones based on names, dates and common words can be cracked quickly by automated tools.
• Phishing. Even a strong password can be stolen if you type it into a convincing fake login page.

A password manager fixes the first two problems. Two-factor authentication greatly reduces the damage from the third, because a stolen password alone is no longer enough to get in.

How password managers work

A password manager is an app that creates, stores and fills in your passwords for you. You remember one strong master password, and the manager remembers everything else.

What it does for you

• Generates strong passwords. It creates long, random passwords that are practically impossible to guess.
• Stores them in an encrypted vault. Your passwords are encrypted on your device before syncing, so they’re unreadable without your master password.
• Fills them in automatically. Browser extensions and mobile apps enter your login details, which saves time.
• Syncs across devices. Your passwords are available on your phone, laptop and tablet.
• Helps you spot problems. Many managers flag reused, weak or breached passwords so you know what to fix first.

Autofill also offers quiet protection against phishing: a good manager will only offer to fill in a password on the website it was saved for. If it doesn’t recognize the site, that’s a warning sign worth paying attention to.

Types of password managers

Type	Pros	Cons
Built into your browser	Free, easy, already installed	Works best within one browser or ecosystem
Built into your device’s operating system	Free, integrates well with that platform	Can be awkward if you mix device brands
Standalone password manager app	Works across browsers and platforms, extra features like secure sharing	Some features may require a paid plan

Any of these is a big improvement over reusing passwords. If you use devices from different brands or several browsers, a standalone manager is usually the most convenient.

How two-factor authentication works

Two-factor authentication (2FA), also called multi-factor authentication, adds a second check when you sign in. Besides something you know (your password), you also need something you have (like your phone or a security key) or something you are (like your fingerprint).

Even if someone steals your password, they still can’t get into the account without that second factor. That’s why security agencies such as the U.S. Cybersecurity and Infrastructure Security Agency recommend turning on multi-factor authentication wherever it’s available.

The main 2FA methods, compared

Method	How it works	Security level	Notes
SMS text codes	A code is texted to your phone	Basic	Vulnerable to SIM swapping and phishing, but far better than nothing
Email codes	A code is sent to your inbox	Basic	Only as secure as your email account
Authenticator app	An app generates a new code every 30 seconds	Strong	Works offline; not tied to your phone number
Push notifications	You approve a sign-in on your phone	Strong	Never approve a request you didn’t start
Hardware security key	A small physical key you plug in or tap	Very strong	Highly resistant to phishing; keep a backup key
Passkeys	A cryptographic key on your device, unlocked by biometrics or PIN	Very strong	Replaces the password entirely on supporting sites

Use the strongest option each account offers. For most people, an authenticator app or passkey is the best balance of security and convenience.

Passkeys: the next step

Passkeys are designed to replace passwords on sites that support them. Instead of typing a password, you confirm your identity with your fingerprint, face scan or device PIN, and your device proves who you are using a cryptographic key.

Passkeys have two big advantages. There’s no password to steal or reuse, and they only work on the genuine website or app they were created for, which makes them highly resistant to phishing. Many password managers and operating systems can now store and sync passkeys, so you can use them across devices. When a site offers you a passkey, it’s usually worth accepting.

Set it all up: a step-by-step plan

You don’t need to secure every account in one afternoon. Work through this in stages.

1. Choose a password manager. Pick one that works on all your devices and browsers.
2. Create a strong master password. A long passphrase of several random, unrelated words is easier to remember and hard to guess. Never use it anywhere else.
3. Turn on 2FA for the password manager itself. This protects the vault that protects everything else.
4. Save your recovery information. Write down recovery codes and store them somewhere safe offline, such as a locked drawer.
5. Secure your email first. Your email account can reset most other passwords, so give it a unique password and the strongest 2FA available.
6. Move on to high-value accounts. Banking, payment apps, your phone carrier, cloud storage and social media are next.
7. Change passwords as you go. Each time you log in somewhere, let the manager generate a new strong password and save it.
8. Fix the warnings. Use your manager’s security report to replace reused or breached passwords.

Within a few weeks of normal use, most of your important accounts will be protected.

Common mistakes to avoid

• Losing your recovery codes. If you lose your phone or forget your master password, recovery codes may be your only way back in.
• Approving surprise sign-in prompts. If you receive a 2FA request or code you didn’t ask for, deny it and change that account’s password. Someone may already have it.
• Sharing codes with “support” callers. Legitimate companies won’t call or message you asking for a verification code. Our guide on how to spot online scams covers this and other common tricks.
• Relying on one device. Add a backup method, such as a second security key or backup codes, so you aren’t locked out if a phone breaks.
• Skipping updates. Keep your devices, browser and password manager up to date to get the latest security fixes.

If you’re setting up a new computer, it’s the perfect moment to start fresh. Our guide on how to choose a laptop includes setup tips, and if you’re using generative AI tools at work, the same account security applies there too, as covered in our piece on generative AI at work.

The bottom line

Password managers and two-factor authentication work best as a pair. The password manager gives every account a unique, strong password without you having to remember them, and two-factor authentication makes a stolen password far less useful to an attacker. Start with your password manager and email account, add 2FA to your most important accounts, keep your recovery codes safe, and accept passkeys when they’re offered. You’ll find more plain-English security and tech guides in our technology section.