Updated September 2026. This guide replaces an older two-factor authentication post on this site. Menu names change occasionally — the steps below follow each company’s own help pages at the time of writing.

Two-factor authentication (2FA) means that signing in needs something besides your password — usually a code or prompt on your phone, a passkey, or a security key. If someone steals your password, they still can’t get in without that second step. This guide explains which 2FA method to choose, shows how to turn it on for your most important accounts, and helps you make sure you never lock yourself out.

How 2FA works

2FA combines two different kinds of proof:

• Something you know — your password.
• Something you have — your phone, an authenticator app or a security key.

It’s like a bank card and PIN: the card alone isn’t enough to take money out. Many services call it 2-Step Verification or multi-factor authentication (MFA) — it’s the same idea.

Which 2FA method should you use?

Recommendation: use passkeys or an authenticator app wherever you can. Add a security key for your main email account if you’re a likely target — for example, if you run a business or manage money for others. SMS is still far better than no 2FA, so use it when it’s the only option.

Where to start: your most important accounts

1. Your main email account — it can reset the passwords of almost everything else.
2. Your password manager.
3. Banking, PayPal and other payment accounts.
4. Your Apple, Google or Microsoft account — they hold your photos, backups and device access.
5. Social media and business accounts.

Turn on 2FA: step by step

Google account (Gmail)

1. Open your Google Account at myaccount.google.com.
2. Select Security & sign-in.
3. Under How you sign in to Google, select Turn on 2-Step Verification.
4. Follow the steps. Google offers passkeys, security keys, Google prompts, Google Authenticator, text or voice codes, and backup codes.
5. Get your backup codes and store them safely.

Facebook

1. Click your profile picture, then Settings and privacy → Settings.
2. Open Accounts Center → Password and security.
3. Click Two-factor authentication and select your account.
4. Choose a security key, an authentication app or text message codes, and follow the instructions.
5. Save your recovery codes.

Instagram uses the same Accounts Center, so you can protect both accounts in one place.

Microsoft account (Outlook, Windows, Xbox)

1. Sign in at account.microsoft.com and open Security.
2. Find the sign-in or advanced security options and turn on two-step verification.
3. Follow the steps and save your recovery code.

Apple Account

Most Apple Accounts already use two-factor authentication. Check on an iPhone in Settings → your name → Sign-In & Security, and make sure your trusted phone number is up to date.

Banks and payment apps

Look in the app’s security settings. Many banks send codes or approval prompts through their own app. Your bank’s help pages will have exact steps — and your bank will never ask you to read a code to them over the phone.

Setting up an authenticator app

1. Install an authenticator app — for example Google Authenticator or Microsoft Authenticator. Many password managers can also store 2FA codes.
2. On the website, choose Authenticator app as your 2FA method. It shows a QR code.
3. In the app, tap + and scan the QR code.
4. Type the six-digit code from the app into the website to confirm.
5. Save the backup codes the website gives you.

Back up your authenticator. Google Authenticator and Microsoft Authenticator can back up codes to your account, so a new phone can restore them. Turn this on, and protect that account with 2FA too. Older guides that describe Authy as working on computers are out of date — its desktop apps were discontinued in 2024.

Don’t lock yourself out

• Save backup codes for every account — print them or store them in your password manager, not in a photo on the same phone.
• Add more than one method where possible, such as an authenticator app plus a passkey or a second security key.
• Keep recovery details current — your recovery email and phone number.
• Before replacing your phone, check your authenticator codes have moved to the new one before you wipe the old one.

If you lose your phone

1. Sign in with a backup code, a second security key or another method you added.
2. Remove the lost phone from your account’s security settings, and set 2FA up again on your new device.
3. Generate new backup codes — the old set may be used up.
4. If you have no backup method, use the service’s account recovery process. It can take several days.

Watch out for 2FA scams

• Never share a 2FA code with anyone who calls, texts or messages you — even if they claim to be from your bank or the service itself.
• Deny login prompts you didn’t start. Repeated prompts mean someone has your password: change it.
• Check the website address before typing a code. Our guide to spotting phishing attacks explains the warning signs.

Frequently asked questions

Is 2FA worth it if I already have a strong password?

Yes. Strong passwords still leak in data breaches and phishing. 2FA protects you when the password alone isn’t enough.

Are text message codes safe?

They’re much better than no 2FA, but the weakest option: attackers can steal codes through SIM-swap scams or fake login pages. Switch to an authenticator app or passkey when a service offers one.

What’s the difference between a passkey and 2FA?

A passkey replaces your password with your device’s fingerprint, face or screen lock and resists phishing. Services such as Google treat it as a strong way to verify it’s you, and it can make separate codes unnecessary.

Do I need 2FA on every account?

Start with email, your password manager, money and your main tech accounts. Then add it to any account that holds personal information or could be used to impersonate you.

Related guides

• Password managers for beginners
• How to create a strong password
• How to spot phishing attacks
• What to do when your data is exposed in a breach