Two-factor authentication (2FA) adds a second step when you sign in, such as a code from an app or a tap on your phone, so a stolen password alone is not enough to break into your account. To turn it on, open the account’s security settings, look for “Two-factor authentication”, “2-Step Verification” or “Multi-factor authentication”, choose a method and save your backup codes. Start with your email, then your bank, cloud storage and social media. This guide explains the methods from weakest to strongest and how to turn 2FA on for the accounts that matter most.
What is two-factor authentication?
Normally you sign in with one factor: something you know, your password. 2FA adds a second, different factor:
- Something you have: your phone, an authenticator app or a security key.
- Something you are: your fingerprint or face.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommends turning on multi-factor authentication for every account that offers it, starting with email and financial accounts. Even if your password leaks in a data breach, an attacker still needs your second factor.
2FA methods compared
| Method | How it works | Security |
|---|---|---|
| Text message (SMS) code | A code is texted to your phone | Better than nothing, but codes can be stolen through SIM swapping or phishing |
| Email code | A code is sent to your email | Only as safe as your email account |
| Authenticator app | An app creates a new code every 30 seconds | Good: works offline and is not tied to your phone number |
| Push notification | You tap “Yes, it’s me” on your phone | Good, if you never approve a request you did not start |
| Passkey or security key | Your device or a physical key confirms it is you | Best: resistant to phishing |
Use the strongest option each account offers. Passkeys are covered in detail in what are passkeys.
How do you turn on 2FA?
The steps are similar everywhere:
- Sign in and open Settings, Account or Security.
- Find the option named Two-factor authentication, 2-Step Verification, Login verification or Multi-factor authentication.
- Choose a method. Prefer a passkey, security key or authenticator app over text messages.
- Follow the setup: for an authenticator app, scan the QR code shown on screen and enter the first code.
- Save your backup codes somewhere safe, such as your password manager or a printed copy at home.
- Sign out and back in to test that it works.
Where to find 2FA on popular accounts
| Account | Where to look |
|---|---|
| Google Account > Security > 2-Step Verification | |
| Apple Account | Two-factor authentication is on by default for most accounts; check Settings > your name > Sign-In & Security |
| Microsoft | Microsoft account > Security > Advanced security options |
| Facebook and Instagram | Accounts Center > Password and security > Two-factor authentication |
| X (Twitter) | Settings > Security and account access > Security > Two-factor authentication |
| Amazon | Your Account > Login & security > 2-step verification |
| Banks | Usually in the app’s security or profile settings |
Menu names change from time to time; if you cannot find the option, search the account’s help center for “two-factor”.
Which accounts should you protect first?
- Your main email: it can reset the password of almost every other account.
- Banking, payment and shopping apps.
- Cloud storage with your photos and documents; see is cloud storage safe.
- Social media accounts, which scammers love to hijack.
- Your password manager and AI accounts that hold your chats and files.
How to avoid locking yourself out
- Save backup codes as soon as you turn on 2FA.
- Add a second method, such as a backup phone number or a second security key.
- Use an authenticator app that syncs or can be transferred to a new phone, and move it before you reset your old phone.
- Keep your recovery email and phone number up to date.
Watch out for 2FA scams
- Never share a 2FA code with anyone who calls, texts or emails you, even if they say they are from the company. Real companies will not ask for it.
- Do not approve sign-in prompts you did not start. Repeated prompts mean someone has your password; change it.
- Type codes only on the real website. Fake login pages can steal codes as well as passwords. Learn the warning signs in how to spot a phishing email or text.
Switching phones soon? Move your authenticator codes before you wipe the old one. Our guide on how to transfer data to a new phone covers it.
If you notice emails disappearing or a forwarding address you did not add, follow our guide on Gmail not receiving emails.
Frequently asked questions
Is 2FA the same as multi-factor authentication?
Yes, for everyday use. Multi-factor authentication (MFA) means two or more factors; 2FA is the most common form.
Is SMS 2FA safe?
It is much better than a password alone, but an authenticator app, passkey or security key is safer because text messages can be intercepted.
Do I still need a strong password with 2FA?
Yes. 2FA is a second lock, not a replacement. Use a long, unique password for each account; our Password Generator can create one, and how to create a strong password explains why.
What if I lose my phone?
Use your backup codes or backup method to sign in, then remove the old phone from your account and set up 2FA on the new one.
Turn on 2FA for your email today
It takes about five minutes and blocks most account takeovers. Once your email is protected, work through your bank, cloud storage and social media accounts the same way.
Sources
This article is based on the official documentation and reporting listed in the sources above, checked on October 19, 2026. Features and prices change, so confirm details on the official pages before you buy. ShokokoTech does not accept payment for coverage. Read our editorial policy.
