Why it matters
Big, familiar companies have had data breaches (see Wikipedia's list). Assume any password could leak, and add a second layer.
Two-factor authentication
Logging in with just an email address and password is not enough for a crypto account. Two-factor authentication (2FA) adds a second check of a different kind, such as a code from an app or a physical security key.
Use a separate, unique password for every exchange, and turn on 2FA as soon as you open the account.
Nearly done: check your inbox and click the link to confirm your subscription.
Authenticator apps vs. security keys
| Authenticator app | Security key (e.g. YubiKey) | |
|---|---|---|
| Cost | Free | You buy the device |
| Security | Strong, but software-based | Physical, needs you to touch it each time |
| If you lose it | You can usually restore the app's codes to a new phone if you set up a backup | You can't log in until the site restores your account, which can take time |
| How you log in | Enter email and password, open the app, type the code | Enter email and password, plug in or tap the key, press its button |
Examples of apps: Google Authenticator and Authy. Security keys: Yubico store (the YubiKey quiz helps you pick a model).
Some sites let you register two security keys, so if you lose one you can still log in with the other. Where that's allowed, do it.
Keep your crypto safe too
Logins are half of it. See Storing it safely for wallets and recovery phrases, and Spotting scams for the warning signs.
Found this useful?
Get the next guide in your inbox. One plain-English crypto email a month for UK readers.
Nearly done: check your inbox and click the link to confirm your subscription.