How to Set Up Two-Factor Authentication (2FA) on Your Accounts
Passwords get stolen all the time, through data breaches, fake login pages and malware. Two-factor authentication, usually shortened to 2FA, is a simple extra step that stops most of these attacks. Even if someone has your password, they cannot get into your account without the second factor.
This guide explains how 2FA works, compares the different methods, and shows you how to switch it on for the accounts you use most.
How two-factor authentication works
Normally you prove who you are with one thing: something you know, your password. 2FA adds a second, different kind of proof, usually something you have, such as your phone, or something you are, such as your fingerprint.
When you log in from a new device, you enter your password and then confirm with that second factor. On devices you trust, most services remember you, so you do not have to do it every time.
Types of 2FA, from weakest to strongest
| Method | How it works | Security |
|---|---|---|
| SMS code | A code is texted to your phone | Good (better than nothing) |
| Authenticator app | An app generates a new code every 30 seconds | Very good |
| Push prompt | You tap "Yes, it's me" on your phone | Very good |
| Passkey or security key | Your device or a USB/NFC key confirms it's you | Excellent |
SMS is the most common but also the weakest, because attackers can sometimes hijack phone numbers through a "SIM swap" scam. Whenever an authenticator app or passkey is available, prefer it.
Setting up an authenticator app
Popular free authenticator apps include Google Authenticator, Microsoft Authenticator and Authy. Many password managers can also generate these codes. The setup process is nearly identical everywhere:
- Install an authenticator app on your phone.
- In your account's security settings, choose Authenticator app as your 2FA method.
- The website shows a QR code. In the authenticator app, tap + and scan it.
- Type the six-digit code shown in the app into the website to confirm.
- Save the backup codes the website gives you.
Turn on 2FA for your Google account
- Go to your Google Account and open the Security section.
- Under How you sign in to Google, select 2-Step Verification.
- Follow the prompts. Google will suggest phone prompts by default. You can also add an authenticator app and passkeys.
Because your Gmail account can reset passwords for most other services, this is the most important account to protect.
Turn on two-step verification in WhatsApp
- Open WhatsApp and go to Settings → Account → Two-step verification.
- Tap Turn on and create a six-digit PIN.
- Add an email address so you can reset the PIN if you forget it.
This stops scammers from registering your number on another phone, even if they trick you into sharing the SMS code. Remember: never share a WhatsApp verification code with anyone, even if the message seems to come from a friend.
Facebook and Instagram
Meta manages security for both apps from the Accounts Center. Open settings in either app, go to Accounts Center → Password and security → Two-factor authentication, pick your account, and choose an authenticator app or SMS.
Banking and payment apps
Most banks and mobile wallet apps already use one-time codes and device binding. Check the app's security settings for options such as biometric login and transaction alerts, and turn them on. Never share a one-time code over the phone; real banks will not ask for it.
Which accounts to secure first
- Your main email account
- Your password manager
- Banking and payment apps
- WhatsApp and other messaging apps
- Social media accounts
- Cloud storage such as Google Drive, iCloud or OneDrive
Frequently asked questions
What if I lose my phone?
Use one of your saved backup codes to sign in, then remove the old phone and set up 2FA again on your new device. This is why saving backup codes is so important.
Does 2FA make logging in annoying?
Only slightly. Most services ask for the second factor only when you sign in on a new device or browser. On your everyday phone and computer, you rarely see it.
Is SMS 2FA still worth using?
Yes. SMS-based 2FA is much safer than a password alone. If a service only offers SMS, turn it on anyway.
Keep reading
What Is a VPN and Do You Actually Need One?
A plain-English explanation of VPNs: what they protect, what they don't, when they're useful, and how to choose a trustworthy one.
SIM Swap Scams: How Criminals Steal Your Phone Number
Learn how SIM swap fraud works, the warning signs, and how to protect your bank and accounts that rely on SMS codes.
10 Signs Your Account Has Been Hacked (and What to Do)
Recognise the warning signs that your email, social media or other accounts are compromised, and take back control quickly.