How to Turn On Two-Factor Authentication — and Which Method to Choose

Most account takeovers don't involve clever hacking. They happen because a password was reused, guessed, or typed into a fake login page. Two-factor authentication (2FA) closes that gap: even if someone has your password, they still need a second thing that only you have.

This guide explains the options in plain language and gives you a simple order for turning 2FA on.

What "two factors" actually means

A login factor is one of three things:

• Something you know — a password or PIN.
• Something you have — your phone, an authenticator app, or a hardware key.
• Something you are — a fingerprint or face scan, usually used to unlock the thing you have.

Two-factor authentication simply means a login needs two different kinds. A password plus a code from your phone counts. Two passwords do not.

The four common methods, from weakest to strongest

1. Codes by text message (SMS)

The site texts you a six-digit code. It is far better than nothing and works on any phone, but it has known weaknesses: messages can be intercepted, and criminals sometimes convince a mobile operator to move your number to a new SIM card ("SIM swapping"). Use SMS only when a service offers nothing better.

2. Authenticator apps

Apps such as Google Authenticator, Microsoft Authenticator or a password manager's built-in authenticator generate a new code every 30 seconds, directly on your phone. Nothing travels over the mobile network, so SIM swapping doesn't help an attacker. For most people this is the best everyday choice.

3. Push approvals

Some services send a prompt to an app on your phone: "Is this you trying to sign in?" It's convenient, but attackers have learned to spam these prompts hoping you tap Approve by mistake. If you receive a prompt you didn't expect, deny it and change your password.

4. Passkeys and security keys

Passkeys and physical security keys use cryptography tied to the real website, so they can't be phished: a fake login page simply can't use them. Where a service supports passkeys, they are the strongest and often the easiest option. (We explain them in detail in our guide to passkeys.)

Secure your accounts in this order

You don't need to do everything today. Start with the accounts that unlock everything else:

1. Your main email account. Whoever controls your email can reset almost every other password.
2. Your phone's account (Apple ID or Google account). It holds backups, photos and often your saved passwords.
3. Banking and payment apps.
4. Social media and messaging, especially accounts that represent your business.
5. Work tools — cloud storage, domain registrar, website hosting and admin panels.

How to turn it on

The exact menu differs by service, but the path is nearly always similar:

1. Open the account's Settings and look for Security, Sign-in & security or Login.
2. Choose Two-factor authentication (sometimes called "2-step verification" or "multi-factor authentication").
3. Pick your method. If an authenticator app is offered, scan the QR code with the app and type in the code it shows.
4. Save your backup codes. Most services give you a list of one-time recovery codes. Print them or store them in your password manager — not in a screenshot in the same phone.
5. Sign out and sign back in once to make sure it works.

Don't lock yourself out

The most common 2FA problem isn't hackers — it's losing your phone. Protect yourself with a few habits:

• Keep backup codes somewhere safe and separate from your phone.
• Add a second method where possible, such as a second security key or a backup phone number.
• When you change phones, move your authenticator app before wiping the old device. Many apps now offer encrypted cloud backup or a transfer option.

The bottom line

If you only do one thing after reading this, turn on two-factor authentication for your email account using an authenticator app or a passkey, and save the backup codes. It takes about five minutes and blocks the most common way accounts are stolen.