What Is Two-Factor Authentication and How to Turn It On

Two-factor authentication (2FA) asks for a second proof of identity after your password. Even if someone learns your password, they cannot sign in without the second factor. It is one of the most effective steps you can take to protect your accounts, and most major services offer it for free.

The three kinds of proof

Something you know: your password or PIN.
Something you have: your phone, a security key or an authenticator app.
Something you are: a fingerprint or face scan.

Two-factor authentication combines two different kinds, usually a password and a code from your phone.

Types of second step

Method	Strength	Notes
Text message code (SMS)	Better than nothing	Can be intercepted or redirected, so use it only if no better option exists
Authenticator app	Strong	Generates codes on your phone without a network connection
Security key	Strongest	A small physical key you plug in or tap
Passkey	Strong and convenient	Uses your device's fingerprint or face unlock

Turn it on for important accounts

Start with your email, because it is used to reset other passwords.
Then do banking, online shopping, cloud storage and social media.
Look for Security or Sign-in settings in each account, then choose two-step verification.
Save the backup codes the service gives you in a safe place, such as your password manager.

Keep access to your codes

If you change phones, move the authenticator app first, or you may be locked out. Keep your backup codes somewhere separate from your phone. Test the setup before you need it.

Watch for approval requests

Some services send a push notification asking you to approve a sign-in. Approve only if you are signing in yourself. If you receive a request you did not start, deny it and change your password.

Frequently asked questions

Is two-factor authentication a hassle?

It adds a few seconds at sign-in, and most services remember trusted devices so you do not need a code every time.

Does two-factor authentication stop all hacking?

No, but it blocks most attacks that rely only on a stolen password. Combine it with strong passwords and care with links, as described in how to spot phishing emails.

Protect your phone number

Because text messages can be redirected by a determined attacker, make sure your mobile account has a PIN or a port-out lock if your provider offers one. Avoid sharing your number publicly, and treat unexpected loss of mobile signal as a warning sign. If you can switch to an authenticator app or a security key, the risk drops considerably.

Set up more than one method

Add a second method, such as a backup security key or a printed set of recovery codes. If your phone is lost or broken, you need another way to sign in. Store the backup codes in a safe place that is not on the same phone, and test the backup method once so you know it works.