Three things live on the security page: your password, two-factor authentication, and passkeys.
Who this is for
Everyone, for their own account.
What happens next
Password: "Ensure your account is using a long, random password to stay secure." Changing it asks for your Current password, which "Confirms it is really you making the change", then the New password twice.
Two-factor authentication: an Authenticator app gives you "a secure, random pin during login, retrieved from the TOTP-supported application on your phone." When you turn it on you are given recovery codes; save them somewhere that is not the phone with the authenticator on it, because they are how you get back in if you lose the device.
Passkeys: "Sign in without a password, using your device's biometrics or security key." A passkey replaces typing a password rather than adding a step to it.
The three are independent: you can hold all of them at once, and doing so is the strongest configuration. A passkey for everyday use, a password with two-factor as the fallback.
Related
Turn on two-factor authentication
Sign in to transglot
Set up single sign-on