What Is Two-Factor Authentication and How to Turn It On

You probably use passwords to sign in to email, banking, shopping, and social media accounts. But passwords can be guessed, stolen in a data breach, or tricked out of you by a convincing scam. If someone gets your password, they may be able to sign in as you.

Two-factor authentication gives your account another layer of protection. If you have been wondering what is two factor authentication and whether it is difficult to use, the good news is that setting it up is usually straightforward. The exact menus vary between services, but the basic idea is the same.

Step 1: Understand what two-factor authentication means

Two-factor authentication, often shortened to 2FA, means proving your identity in two different ways when you sign in. The first is usually something you know, such as your password. The second is something you have, such as your phone or a security key, or something you are, such as a fingerprint.

For example, after entering your password, a service might ask you to approve a sign-in notification on your phone or enter a one-time code. A one-time code is a number that is valid for a short time or for one sign-in.

This extra check can help protect your account even if someone has learned your password. It is not a guarantee against every scam, but it makes it harder for someone to sign in using the password alone.

Good to know: Some services call this “two-step verification,” “multi-factor authentication” (MFA), or “login verification.” The names can differ, but they all add another check beyond your password.

Step 2: Choose a second verification method

Many online services offer more than one way to confirm it is really you. The available choices depend on the service and your device.

• Authenticator app: An app on your phone creates short-lived sign-in codes. It can often work without a mobile signal once it is set up.
• Approval notification: A prompt appears on a trusted device, and you approve or deny the sign-in.
• Security key or passkey: A physical key or a device-based sign-in method helps confirm your identity. Passkeys use your device’s built-in security and can be more resistant to fake sign-in websites.
• Text message code: The service sends a code to your phone number. This is generally better than using only a password, although it can be less secure than an authenticator app or security key.

If you have a choice, an authenticator app, passkey, or security key is usually preferable to a text message code. Choose a method you can use reliably, and add a backup method if the service allows it.

Tip: If you use your phone for sign-in approvals, make sure you have a way to access your account if the phone is lost, damaged, or replaced.

Step 3: Find the security settings for your account

You normally turn on two-factor authentication separately for each online account. Start with your most important accounts, especially your main email account, because email can be used to reset passwords for other services.

1. Open the service’s official app or type its known website address into your browser.
2. Sign in to your account.
3. Open Settings, Account, or your profile menu.
4. Look for a section called Security, Sign-in and security, or Password and security.
5. Find an option named Two-factor authentication, Two-step verification, or Multi-factor authentication.

If you cannot find the setting, search the service’s official Help or Support pages for “turn on two-factor authentication.” Do not follow a link in an unexpected email or text claiming to help you secure your account.

Step 4: Turn on two-factor authentication

Once you have found the setting, follow the service’s instructions. The process often involves confirming your password and registering your chosen second method.

1. Select Turn on, Enable, or Set up beside the two-factor authentication option.
2. Choose your preferred method, such as an authenticator app or approval notification.
3. Follow the on-screen instructions. For an authenticator app, the service may show a QR code, which is a square image the app can scan to connect your account.
4. Enter the code from the app if the service asks you to confirm setup.
5. Save or download any recovery codes the service provides.

Recovery codes are backup codes you can use if you cannot access your usual verification method. Keep them somewhere secure and separate from your phone. Do not share them with anyone who contacts you.

Careful: Never read a sign-in code or recovery code to someone who calls or messages you unexpectedly. A genuine support worker should not need you to tell them a code to prove your identity.

Step 5: Test your new sign-in method and save backup options

Before closing the settings page, make sure you understand how the new sign-in process works. Some services will ask you to sign in again or confirm the method on another device.

1. Follow the service’s test or confirmation step, if one appears.
2. Check that the code or approval notification arrives on the device you registered.
3. Add a backup method if the service offers one, such as a second trusted device or another authenticator option.
4. Store recovery codes in a secure place, such as a reputable password manager or another protected location.
5. Check that your recovery email address and phone number are current.

If you change phones, transfer your authenticator accounts or set up a new method before wiping or trading in your old phone. The transfer process varies by authenticator app and online service.

Step 6: Repeat the process for your other important accounts

Two-factor authentication is not automatically switched on everywhere just because you enabled it for one account. Set it up separately on other services that support it.

Prioritize accounts that could cause the most difficulty if someone took them over:

1. Your main email account.
2. Online banking and payment services.
3. Apple, Google, or Microsoft accounts used to manage your devices.
4. Social media and messaging accounts.
5. Shopping, cloud storage, and other accounts containing personal information.

Use each service’s official app or website to find its security settings. The names and steps will vary, so follow the current instructions provided by that service.

Troubleshooting: If two-factor authentication is not working

The code is not accepted. Check that you are using the code for the correct account and that it has not expired. Authenticator codes change regularly, so enter the current one.

I have a new phone. If you still have your old phone, use the authenticator app’s transfer process or the service’s instructions to register the new device. If you have lost access, use the service’s official account recovery process and your saved recovery codes.

I am not receiving a text message. Check that your phone has signal and that the number on the account is correct. Look for another verification method or contact the service through its official support channel.

I am worried about being locked out. Before signing out, confirm that your second method works and save your recovery codes securely. Do not turn off the protection simply because setup seems unfamiliar; use the service’s help instructions if you get stuck.

A safer sign-in, one account at a time

Two-factor authentication adds an extra check that can help keep someone out of your account even if they know your password. Start with your main email account, save your recovery options, and then enable it on your other important accounts. A few minutes of setup can make a meaningful difference to your online security.