Short answer: yes — passkeys are stronger than TOTP codes because they cannot be phished, but coverage is still patchy. Most banks, exchanges and smaller services do not support them yet, so your authenticator app stays essential for now. Here’s how to decide account by account.

Short answer: go to myaccount.google.com/security, open 2-Step Verification, and turn it on. But the default setup leaves SMS as a weak link — here’s the full six-step version that adds an authenticator app, a passkey, offline backup codes, and closes the SIM-swap back door.

Short answer: a SIM swap attack is when someone convinces your carrier to move your phone number to their SIM card, so every SMS 2FA code arrives on their phone instead of yours. Here’s how the attack unfolds, the warning signs, and the five things that actually prevent it.

Short answer: nine times out of ten it’s your phone’s clock. TOTP codes are calculated from the current time, so drift of more than 30 seconds produces valid-looking codes that the server rejects. Here are all seven causes and how to diagnose which one you have.

Short answer: open Settings → Password and authentication, click Enable two-factor authentication, and scan the QR code with your authenticator app. GitHub requires 2FA for contributors now — and there’s one follow-up step with git over HTTPS that catches almost everyone out.

Short answer: go to Settings → Security, enable two-step verification, and pick an authenticator app or security key. But the setup isn’t done until you’ve removed SMS — crypto accounts are the number one target for SIM swap attacks, and blockchain transfers can’t be reversed.

Short answer: an authenticator app is meaningfully safer than SMS 2FA, because text-message codes can be intercepted through SIM swapping and phishing proxies without ever touching your phone. But SMS is still far better than no second factor at all. Here’s when to switch — and when to keep SMS as a backup.