Protect Your Accounts with Two-Factor Authentication

The single most effective step you can take to protect an account even if your password is stolen, with step-by-step setup for major platforms.

Two-factor authentication↗ (2FA), also called two-step verification, asks for a second piece of proof beyond your password when you sign in. That way, even if your password is stolen or guessed, an attacker still cannot get into your account. Setting it up takes a few minutes, and it is one of the most effective security steps you can take.

A simple picture

Think of a bank vault that needs both a key and a code. A thief who steals only the key, or only the code, gets nowhere. With 2FA your password is the key, and the second factor is the code. Both are needed.

How does it work?

Proof of identity comes in three kinds: something you know (a password), something you have (your phone or a security key↗), and something you are (a fingerprint or your face). 2FA combines two different kinds, so one stolen password is no longer enough.

Start with your most critical accounts

You do not need to turn it on everywhere at once. Start with email, online banking, and social media. Your email comes first, because password-reset links go there, so whoever controls your email can take over your other accounts.

Which method is more secure?

Method	How it works	Strength
Passkey↗ or hardware security key	Your device or a small physical key proves it is you, with no code to type	Strongest: a fake login page cannot trick it
Authenticator app	An app on your phone shows a six-digit code that changes every 30 seconds	Strong, works without a signal, and safer than text messages
SMS code	A code arrives by text message	Better than nothing, but a criminal can take over your phone number with a SIM-swap scam

A passkey is a modern sign-in method that replaces the password with your fingerprint, face, or device PIN.

Step-by-step setup

Google / Gmail account (Android and iPhone)

From the Google app or your browser: Google Account → Security → "2-Step Verification" → follow the on-screen steps. Adding an authenticator app (such as Google Authenticator) is recommended.

Apple ID (iPhone)

Settings → [your name] → "Sign-In & Security" → turn on "Two-Factor Authentication".

Instagram, Facebook, X and similar apps

Usually under Settings → Account/Security → "Two-factor authentication". Choose "Authenticator app" as the method where it is offered.

Menu names change between versions. If you cannot find an option, search the account's security settings for "two-factor", "two-step", or "verification".

Keep your recovery codes safe

When you turn on 2FA, you are given backup↗ or recovery codes. Save them somewhere safe, such as a password manager↗ or a printed copy kept at home. If you lose your phone, these codes let you back into your account. If possible, also add a second verification method, such as a backup email or a second device.

What if I lose my phone?

Use a recovery code, or sign in on another device where you are already signed in.
Remove the lost phone from your account's trusted devices.
Set up the authenticator app again on your new phone. Many apps can back up or transfer codes, so check this before you need it.

Common questions

Question	Short answer
Is it a hassle every time?	Usually not. Many services only ask on a new device or after a long time.
Should I share a code if someone asks?	Never. A real company will not ask for your code. Anyone who does is trying to get into your account.
Does 2FA replace a strong password?	No. It adds to it. Use both.

Pair it with a strong password

Two-factor authentication does not replace a strong, unique password. It complements it. Using both together makes your accounts far more resilient.