Multifactor authentication (MFA) asks you to prove your identity with more than one kind of evidence. It can reduce the damage caused by a stolen password, but methods differ in their resistance to phishing, recovery options, and ease of use. The best choice is a strong method you can use consistently and recover safely if a device is lost.
Common methods
Passkeys use cryptographic credentials tied to a device or synced credential manager. They are designed to resist traditional phishing because the credential is associated with the legitimate website or app.
Security keys are physical devices used to authenticate. They can provide strong phishing resistance when supported by the service and configured correctly. Keep a spare key registered where possible.
Authenticator apps generate time-based codes or support approval flows. They are widely supported and generally preferable to SMS where the account offers them, but users can still be tricked into giving a code to a phishing site.
Push approvals send a request to a registered device. Approve only a sign-in you initiated; number matching and clear context can reduce accidental approvals. Repeated unexpected prompts can be an attack signal.
SMS codes are widely available but can be exposed through phone-number takeover, SIM-swap attacks, or social engineering. SMS may still be better than having no MFA when stronger methods are not supported.
Prioritize important accounts
Protect your primary email first because it often controls password resets for other services. Then protect your password manager, financial accounts, cloud storage, and work access. If the service supports passkeys or security keys, consider those options for high-impact accounts. Follow your employer’s rules for work accounts rather than configuring personal methods that conflict with policy.
Set up recovery before you need it
Save backup codes in a secure place. Register a second security key or a supported backup method when possible. Keep recovery email and phone details current, and understand what happens if your phone is lost. Do not store backup codes in a plain text file on the same device you use to authenticate.
Avoid common mistakes
- Never approve an unexpected push request.
- Never share a one-time code with someone who contacts you—even if they claim to be support.
- Do not disable MFA just because setup is inconvenient; choose a method that fits your devices and recovery needs.
- Review active sessions and revoke devices you no longer recognize.
- Use a unique password even when MFA is enabled.
Common questions
Which MFA method is strongest?
For many phishing threats, passkeys and properly configured security keys offer strong protection. The best choice depends on service support, devices, threat model, and recovery plan.
Is an authenticator app safer than SMS?
Usually it is less exposed to phone-number takeover, although codes can still be phished. Enable the strongest practical method the service supports.
Does MFA make a weak password acceptable?
No. Use both a unique password and MFA; either measure alone has limits.
Related KiwiVPN guides
Read Password managers, How to spot phishing, and A practical remote-work security setup.
Further reading
Browse all KiwiVPN guides or return to the public IP checker.