Two-step verification (also called two-factor authentication or 2FA) means that signing in needs two things: something you know, like your password, and something you have, like your phone. Even if someone gets your password, they still cannot get in without the second step.
Which accounts to do first
- Your main email account, since it can reset everything else.
- Your bank and any payment apps.
- Your Apple or Google account.
- Your password manager.
- Social media and your mobile phone carrier account.
Kinds of second step, from good to best
- Text message codes: better than nothing, and easy to start with.
- An authenticator app such as Google Authenticator or Microsoft Authenticator, or one built into your password manager: creates codes on your phone, and is harder to intercept than a text.
- A prompt on your phone asking "Is this you signing in?" Only tap Yes if you are signing in right now.
- Passkeys or a physical security key: the strongest options for most people.
How to turn it on
- Sign in to the account and open its settings.
- Look for Security, Sign-in, or Login and security.
- Find two-step verification or two-factor authentication and choose Turn on.
- Follow the steps to connect your phone or authenticator app.
- Save the backup codes it offers. Print them or store them in your password manager.
Do not skip the backup codes
Backup codes (sometimes called recovery codes) let you in if you lose your phone. Without them, getting back into an account can take a long time. Keep them somewhere safe and separate from your phone.
One important warning
Never share a verification code with anyone who contacts you, even if they say they are from the company. The code is meant only for you, at the moment you are signing in. If you get a code or a sign-in prompt you did not ask for, someone may have your password: do not approve it, and change that password.
Want help turning this on across your accounts? Get tech help.