Step by step · Official links
Turn on two-factor.
Account by account.

Choose the strongest method each account offers

Two-factor authentication (2FA), also called two-step verification or multi-factor authentication, asks for something in addition to your password. The methods are not equal. Use the best one each account supports, in this order:

1. Passkey or security key. The credential is tied to the real website, so a lookalike page cannot collect it or relay it. This is the phishing-resistant option.
2. Authenticator app. Your phone generates the code, with no text message involved, so SIM swapping does not affect it. You can still type the code into a fake page, so check the address before you enter it.
3. SMS or phone call. Better than a password alone, but a text message can be intercepted. An attacker who convinces your carrier to move your number to a new SIM card (a SIM swap) receives your codes. Use it when nothing else is offered, and ask your carrier about an account PIN.

Push approvals (“Is this you trying to sign in?”) are convenient: approve only a request you started yourself, a few seconds earlier. No method helps if you read a code to someone who calls you. Our passkeys and passwords guide explains why domain-bound sign-in resists phishing.

Plan your recovery before you need it

The most common 2FA problem is not an attack; it is a lost, broken or replaced phone. Before you close the setup screen:

• Save the backup codes. Most services offer one-time recovery codes. Store them in your password manager, or print them and keep the sheet somewhere safe. Each code works once.
• Add a second method. A second security key, a passkey on another device or a backup phone number keeps you in if one device goes missing.
• Check your recovery email and phone number. Account recovery often goes through them, so make sure they are current and protected too.
• Move your authenticator before you change phones. Set up the new phone, confirm that its codes work, then wipe the old one.

Start with your main email account: whoever controls it can reset most of your other passwords.

Service by service

Menus change often. The steps below name the settings area; the official help article linked under each service has the current, detailed instructions.

Google (Gmail, YouTube)

1. Open your Google Account and select Security & sign-in.
2. Under How you sign in to Google, turn on 2-Step Verification and follow the prompts.
3. Add a passkey or security key if you can, and save your backup codes.

Official help: Turn on 2-Step Verification.

Microsoft account (Outlook.com, Xbox, OneDrive)

1. Sign in to your Microsoft account and open the Security tab.
2. Select Manage how I sign in.
3. Under Additional security, turn on Two-step verification and follow the prompts.

Official help: How to use two-step verification with your Microsoft account. A work or school account is managed by your organization: follow your IT team’s instructions.

Apple Account

1. On iPhone, open Settings, tap your name, then Sign-In & Security.
2. Turn on two-factor authentication and follow the prompts.
3. Confirm that your trusted phone number is current.

Most recent Apple Accounts already have it on. Official help: Two-factor authentication for Apple Account.

Facebook

1. Select your profile picture, then Settings and privacy, then Settings.
2. Open Accounts Center, then Password and security.
3. Choose Two-factor authentication, select your account and pick a method.

Official help: How two-factor authentication works on Facebook.

Instagram

1. In the app, open Settings, then Accounts Center.
2. Choose Password and security, then Two-factor authentication.
3. Select your account and choose an authentication app if possible.

Official help: Securing your account with two-factor authentication.

WhatsApp

1. Open WhatsApp Settings, then Account.
2. Choose Two-step verification and turn it on.
3. Set the PIN or password it asks for and add an email address for resets.

Official help: How to manage two-step verification settings.

Amazon

1. Go to Your Account, then Login & security.
2. Select Edit next to the Two-Step Verification (2SV) settings, then Get Started.
3. Choose an authenticator app or text messages and follow the prompts.

Official help: What is Two-Step Verification?

PayPal

1. Log in on the PayPal website and select the Settings icon.
2. Open Security, then select Set Up next to 2-step verification.
3. Choose an authenticator app if offered, and follow the prompts.

Official help: What is 2-step verification?

LinkedIn

1. Select Me, then Settings & Privacy.
2. Open Sign in & security, then Two-factor authentication.
3. Turn it on, choose a method and follow the prompts.

Official help: Turn two-factor authentication on and off.

X (formerly Twitter)

1. Open Settings and privacy, then the security and account access area.
2. Choose Two-factor authentication.
3. Pick a security key or an authentication app, and save the backup code.

Text message codes are limited to some subscribers. Official help: How to use two-factor authentication.

Dropbox

1. Sign in on dropbox.com, open your avatar menu and select Settings.
2. Go to the Security tab and turn on two-step verification.
3. Choose an authenticator app or text messages, then save your backup codes.

Official help: How to turn two-factor authentication on and off. If your settings say the account is managed by single sign-on, your administrator controls this setting.

Finish the job with a few free tools

Two-factor authentication works best on top of unique passwords. Replace any reused password with one from our password generator, and use the breach checker to see whether a password you still use has appeared in a known leak. The local password audit helps you spot weak, reused or old entries in your password manager export without uploading anything.

To understand why passkeys go further than codes, read passkeys vs passwords. And because attackers now target the second factor itself, our fake IT support guide shows how a phone call can be used to relay an MFA code, and how to respond.