How to set up two-factor authentication (2FA) on your accounts

Two-factor authentication (2FA) adds a second check when you log in: something you know (your password) plus something you have (your phone or a security key). Even if your password leaks in a data breach, an attacker without that second factor is stopped at the door. It is one of the most effective security steps you can take, and it takes about ten minutes per account.

The main types of 2FA, from strongest to weakest

1. Passkeys and hardware security keys. A physical key or a passkey stored on your device. They resist phishing because they only work on the real website.
2. Authenticator apps. Apps such as Google Authenticator, Microsoft Authenticator or the one built into your password manager generate a new six-digit code every 30 seconds, even offline.
3. Push notifications. You tap “Approve” on your phone. Convenient, but never approve a prompt you did not trigger.
4. SMS codes. Better than nothing, but text messages can be intercepted or redirected through SIM-swap fraud.

For most people, an authenticator app is the best balance of security and convenience. Use SMS only when a service offers nothing else.

Which accounts to protect first

• Your main email. Password resets for everything else go there, so it is the master key.
• Banking and payment apps.
• Your password manager.
• Apple ID, Google or Microsoft account. These control your phone, backups and photos.
• Social media. Hijacked accounts are often used to scam your friends.

How to turn on 2FA with an authenticator app

1. Install an authenticator app on your phone.
2. Log in to the account on a computer and open its security settings. Look for “Two-step verification”, “2FA” or “Login verification”.
3. Choose “Authenticator app”. The site shows a QR code.
4. In the app, tap “Add” and scan the QR code. A six-digit code appears.
5. Type that code into the website to confirm.
6. Save the backup codes the site gives you. Store them in your password manager or print them and keep them somewhere safe.

Avoid getting locked out

The biggest fear with 2FA is losing your phone. Plan for it now:

• Keep the backup codes for every account.
• Use an authenticator that can back up to the cloud or sync to a second device.
• Add a second method where allowed, such as a spare security key.
• When you change phones, move your authenticator accounts before wiping the old one.

2FA works best alongside strong, unique passwords. If you are still reusing passwords, start with our guide on how a password manager keeps you safe.

Frequently asked questions

Is 2FA the same as two-step verification?

For everyday purposes, yes. Companies use different names for the same idea: a second check after your password.

Can 2FA be hacked?

Codes can be stolen by convincing phishing pages, and SMS can be redirected. Passkeys and security keys are the hardest to defeat. Any form of 2FA is still far safer than a password alone.

Do I need 2FA if I have a strong password?

Yes. A strong password does not help if the website storing it is breached. 2FA protects you in that case.