Two-factor authentication everywhere

A password alone is one secret away from disaster. The second factor should live on a different device: an authenticator app (TOTP codes that work offline) beats SMS, which fails without signal and can be SIM-swapped. Passkeys go further and remove the password entirely.

The unglamorous part matters most: print the recovery codes and store them with your password manager emergency kit. Every «locked out of everything» story starts with a lost phone and no recovery codes.

Pick the method by account value

Mail and password vault first: hardware key or passkey where offered, authenticator app everywhere else. Social networks and shops get the authenticator app too — they are the rehearsal stage for account recovery. SMS codes only where nothing better exists, and treat those accounts as single-factor with extra vigilance.

Travel and phone loss drill

Before any trip: confirm recovery codes exist for mail and vault, install the authenticator on a second device or export its seeds encrypted, and tell one trusted person where the emergency kit lives. A lost phone abroad with no codes turns a bad day into a locked-out month — this drill takes twenty minutes once.