Signing in safely: 2FA, passkeys and account recovery
Two-factor codes, authenticator apps, SIM swap risk, passkeys, security keys, biometrics and recovery options, explained without jargon or scare stories.
A password on its own is one secret that can be stolen once and then used anywhere. The second step at sign-in is what makes that theft survivable, and it is also the part most people set up badly: codes sent by text message, no backup of anything, and a recovery address they stopped using years ago. What follows covers the whole moment of signing in, from two-factor codes to passkeys that drop the password altogether.
If you are starting from nothing, read what two-factor authentication actually does, then get your codes off text messages by setting up an authenticator app with working backups. Where a site offers them, passkeys take the password out of the process and cannot be handed to a fake login page. If your face or fingerprint unlocks any of this, the caveats are worth reading before you rely on it.
The step nearly everyone skips is the last one. Arrange account recovery before you need it, while you still have the phone, the backup codes and the old address in front of you. The morning your handset goes missing is a bad time to discover what is missing. An old address you rely on for resets has its own risk: most free providers delete a mailbox after a year or two without use, and the inactivity deadlines at Gmail, Outlook.com, Yahoo, iCloud and Proton tell you how often to visit it. An old phone number is the same risk on a faster clock: in the US a disconnected number can go to a new customer after 45 days, and how long before a phone number is reassigned covers what to move before you let one go.
The codes themselves run on short clocks too. How long 2FA codes last explains why an app code changes every 30 seconds while a texted one usually survives 5 to 10 minutes, and what to check when every code is rejected.
Reset links run on longer clocks, and nobody agrees how long. How long password reset links last sets Okta, Plesk and Laravel at 1 hour against Zendesk at 24 hours and Auth0 at 5 days, and explains why only the newest link works.
The device that receives those codes has a clock of its own. How many wrong passcode attempts before a phone locks sets the iPhone limit of 10 against the 20 that Android 16 QPR2 and later allow, and explains when a locked phone ends up erased.
Articles in this hub
- Two-factor authentication explained in plain EnglishWhat the second factor really is, which attacks it blocks, which ones it does not, the accounts to protect first, and the objections that keep people from turning it on.
- Setting up an authenticator app properly, including backupsHow to move your two factor codes to an app without locking yourself out: what the QR code contains, where to store recovery codes, and how to handle a new phone.
- Passkeys explained: signing in with no password at allWhat a passkey is, how the phishing resistance actually works, what happens when you lose the device, and whether it is time to switch your main accounts over.
- Face and fingerprint unlock: safer than a PIN, with caveatsWhat happens when you unlock with your face, why the biometric never leaves the device, where it is weaker than a passcode, and the legal difference worth knowing.
- Account recovery: set it up before you need itRecovery is how most accounts are actually lost and stolen: the settings to fix today, the recovery contacts and codes to store, and the fifteen minute audit that prevents a very bad week.
- Your email account is the master key: lock it properlyWhy the email account is the single most valuable target, the settings that stop a silent takeover, and the hidden forwarding rules attackers leave behind.
- How long before an inactive email account is deleted?Inactivity deadlines for Gmail, Outlook.com, Yahoo Mail, iCloud and Proton, what counts as signing in, what deletion takes with it, and how to keep an old address alive.
- How long before a phone number is reassigned?US carriers must hold a disconnected number 45 to 90 days before reissuing it. When that clock starts, what the new owner gets, and how to keep your number.
- How long do 2FA codes last?Authenticator app codes last 30 seconds, texted and emailed codes usually 5 to 10 minutes. The limits from NIST, Twilio, Okta, Microsoft and AWS side by side.
- How many wrong passcode attempts before a phone locks?An iPhone allows 10 wrong passcodes, Android 16 QPR2 and Android 17 allow 20, a new Samsung 13. Every wait side by side, and when the phone erases itself.
- How long do password reset links last?Usually 1 hour, but defaults run from 10 minutes to 5 days. What Okta, Microsoft, Auth0, Zendesk, Plesk, Laravel and Django set, and why only the newest link works.