About the Two-Factor Auth Coverage Planner
“I think most of my stuff has 2FA” is the sentence this tool exists to replace. Add the services you actually use and you get back, for each one, the strongest second factor it genuinely supports — not a generic recommendation, but what that provider has implemented — with a link to their own setup page.
The ranking is by phishing resistance, not popularity. A security key is bound to the site’s origin and will not sign for a fake login page. An authenticator app has no idea what site you are on, so a convincing replica can relay your six digits to the real service inside the thirty-second window. And a code sent by SMS can be redirected to somebody else’s phone with a persuasive call to your carrier — which is why NIST SP 800-63B classifies SMS as restricted. All three are better than nothing. They are not interchangeable.
The plan is ordered deliberately, and the order is email first. Nearly every other account has a “forgot password” link pointing at your mailbox, so a hardened bank behind an unprotected inbox is not hardened at all. Source data is the community-run 2fa.directory, 2,569 services. Your account list stays in your browser and is never sent to us.
A print-ready version of the ordered checklist with every setup link written out, for working through away from the screen or handing to a relative.
How to Use the Two-Factor Auth Coverage Planner
Search for the services you actually use and add them — start with your email providers, then anything holding money, then everything else. The tool looks each one up in a directory of 2,569 tracked services and tells you the strongest second factor that provider has genuinely implemented. You then get an ordered plan, with the official setup page for each account linked directly, so you are never hunting through a settings menu wondering where the option lives.
Your list lives in your browser’s local storage and is never transmitted to us. That is a deliberate constraint: a file listing exactly which financial and email services one person uses is precisely the sort of thing that should not sit on a third party’s server.
The Four Tiers, and Why the Gaps Between Them Are Uneven
Every account lands in one of four tiers, and the distance between them is not equal.
- Security key or hardware token. A FIDO/WebAuthn key is bound to the origin. Put it on a pixel-perfect replica of your bank’s login page and it will refuse to produce a signature, because the domain does not match the one it registered against. It is not that the key is harder to fool — it cannot be fooled by a wrong domain at all. This is the only tier that survives a genuinely convincing phishing page, and just 12% of tracked services offer it.
- Authenticator or push app. A rolling six-digit code, or a prompt on your phone. Immune to SIM swapping, and a real improvement. But the app has no idea which site you are looking at, so a relay attack — fake page takes your code, forwards it to the real site within the thirty-second window — works. Push prompts add their own failure mode: approve enough spurious ones at two in the morning and eventually somebody taps yes. This is the largest tier by far, at roughly 48% of services.
- Codes by SMS, phone call or email. Better than nothing, and where it is the only option you should absolutely turn it on. But a SIM-swap attack moves your number to an attacker’s handset after a persuasive call to your carrier, and the SS7 network that routes messages between carriers has documented interception weaknesses. An emailed code is only ever as strong as the mailbox it arrives in.
- Nothing. The tier that surprises people. Of 2,569 tracked services, 685 — more than one in four — offer no second factor whatsoever. For those accounts the only defence available to you is a long unique password in a password manager, and knowing which of your accounts are in this state is worth more than any amount of general advice.
What the Whole Dataset Shows
Aggregated across all 2,569 tracked services, some categories are far better defended than others, and the pattern is not the one most people expect.
- Universities are the best-secured category in the file — around 70% support security keys, a legacy of federated academic identity systems that consumer services never adopted.
- Insurance is the worst. Not one insurer in the dataset supports a security key, and close to 60% offer nothing stronger than a code sent to you.
- Banking is bimodal. Roughly a fifth support security keys, while more than a quarter of tracked banks still offer no second factor at all — which is why checking yours specifically beats assuming the sector has it covered.
- Retail is where nothing lives. Over half of tracked retailers have no second factor, on accounts that typically hold a saved card and a home address.
- Crypto services cluster in the app tier — around 87% — with fewer than one in ten supporting a security key, on accounts holding bearer assets that cannot be reversed or charged back.
Why the Order Matters More Than the List
Most two-factor advice hands you an undifferentiated checklist. That is the wrong shape, because these accounts are not independent of each other. Almost every service on your list has a “forgot password” link, and almost all of those send a reset to your mailbox. An attacker who controls your email does not need to defeat your bank’s two-factor setup; they ask the bank to reset the password and read the message. Hardening a bank behind an unprotected inbox is not hardening it.
So the plan is ordered email and identity first, then anything holding money, then cloud storage and domains, then everything else — and within each group, whichever accounts are currently weakest. That ordering is an editorial judgement rather than a computed fact, and it is stated openly for that reason.
One more thing worth doing while you are in each settings page: once a stronger factor is enabled, check whether SMS is still switched on as a fallback. Many services leave it active alongside the new method, which means the account remains only as strong as the weakest route into it. Removing the fallback is often the single highest-value click in the whole exercise.
Where the Data Comes From, and Its Limits
The directory is 2fa.directory, an open, community-maintained dataset. It is strong on banks, exchanges, universities and mainstream platforms, and thinner on small regional providers. Two honest caveats: a service being absent is not evidence it lacks two-factor authentication, and entries can lag reality in either direction — a provider may have added security-key support last month without the dataset catching up. Treat this as an excellent starting map and the provider’s own security settings page as the final word.
One term this tool deliberately does not use is passkey. The dataset records FIDO/WebAuthn security-key support but has no separate passkey flag, so claiming passkey availability per service would be inventing precision the source does not have. Where you see “security key”, read it as WebAuthn support — which in practice is what passkeys are built on.
Checking whether an account has already been caught in a breach? The Breach Directory covers that, and the Password Strength Estimator estimates how long a specific password would actually survive. Browse every Security & Privacy tool for more.
Frequently Asked Questions
Is SMS two-factor actually bad?
SMS is far better than nothing and you should turn it on where it is the only option. But it is the weakest common second factor, for two concrete reasons: a SIM-swap attack moves your number to an attacker's phone with a convincing phone call to your carrier, and the SS7 signalling network that routes messages between carriers has known interception weaknesses. NIST's digital identity guidance, SP 800-63B, classifies SMS as a restricted authenticator for exactly these reasons. Treat it as a floor, not a destination.
What makes a security key different from an authenticator app?
A security key is bound to the website's origin. If you land on a convincing fake login page, the key simply will not produce a signature for it, because the domain does not match the one it registered with. An authenticator app has no idea what site you are on — it shows a six-digit code and you type it wherever you are asked to, including into an attacker's page that relays it to the real site within the thirty-second window. That is the entire difference, and it is the reason phishing-resistant is a category of its own.
Where does my list of accounts go?
Into your own browser's local storage, and nowhere else. The service directory is fetched from our server once and everything after that happens in the page. We never receive, store or transmit which accounts you selected. If you clear your browser data the list goes with it, which is the trade-off for not having it sit on somebody else's server.
Why does the plan start with email rather than my bank?
Because almost every other account on the list has a "forgot password" link that sends a reset to your mailbox. Hardening a bank account while its recovery mailbox is protected by nothing means an attacker skips the bank's defences entirely and takes the mailbox instead. Email is the master key, and it is also the account people most often assume is fine.
A service I use is not in the directory. What does that mean?
Only that nobody has contributed it yet. 2fa.directory is a community-maintained dataset of 2,569 services, and it is very good on banks, exchanges and mainstream platforms while thinner on smaller regional providers. Absence is not evidence that a service lacks two-factor authentication. It is also worth knowing that entries can lag reality in both directions, so treat the directory as a strong starting point and the provider's own settings page as the final word.
