A password can be stolen. Two-factor authentication requires something else as well, so a stolen password alone is not enough. The methods differ substantially in how well they work.
SMS codes
A code texted to your phone. Better than nothing and the weakest option.
The vulnerability is SIM swapping – convincing your mobile operator to transfer your number to a new SIM, which redirects the codes. This is a documented and repeated attack, particularly against people with valuable accounts.
Authenticator apps
An app generates a code that changes every thirty seconds, calculated from a secret shared once at setup. Nothing is transmitted, so nothing can be intercepted.
Substantially stronger than SMS. The main risk is losing the device, which is why the backup codes offered at setup should be saved somewhere safe.
Hardware keys
A physical device you plug in or tap. The strongest option available, and the only one that reliably defeats phishing – the key checks which site is asking and refuses to respond to a fake one.
The trade-off is cost and the need to carry it. Anyone with a high-value account should have one, plus a backup key stored elsewhere.
Passkeys
The newer approach that replaces the password entirely with a cryptographic key on your device. Phishing-resistant like a hardware key, without the separate object.
The practical priority
Turn on something everywhere it is offered. Use an app rather than SMS where you can choose. Use a hardware key or passkey on your email, since that is the recovery path for everything else.