Two-factor authentication (2FA) asks for a second proof of identity besides your password. If someone learns your password, they still cannot get in without the second factor.
The idea
You prove who you are with two different things:
- Something you know, such as a password.
- Something you have, such as your phone or a security key.
- Something you are, such as a fingerprint or face scan.
Common types of 2FA
Authenticator app. An app on your phone shows a six-digit code that changes every 30 seconds or so. This is a good balance of safety and ease.
Security key. A small physical key you plug in or tap. It is very hard to trick and is a strong choice for important accounts.
SMS code. A code is sent to your phone number. It is better than nothing, but weaker, because phone numbers can sometimes be taken over or messages intercepted.
Prompt on your phone. An app asks “Is this you?” and you approve. Read the details before tapping yes.
Which accounts first
Turn it on for the accounts that would hurt most if lost:
- Your main email, because other accounts reset through it.
- Banking and payment apps.
- Social media and messaging accounts.
- Cloud storage and work accounts.
How to set it up
- Open the account’s security settings.
- Choose two-step or two-factor verification.
- Pick an authenticator app if offered.
- Scan the QR code shown, then type the first code to confirm.
- Save the backup codes in a safe place, such as a notebook kept at home.
Do not forget your password
2FA works together with a strong password, not instead of it. Use a long, unique password for each account. The password generator creates one in your browser without sending it anywhere. Our guide on choosing strong passwords has more.
If you lose your phone
- Use your backup codes to log in.
- Move your authenticator to a new phone as soon as you can.
- Some apps let you transfer accounts. Check this before you replace a phone.
Warning signs
- Never share a code, even with someone who says they are from the bank or the platform. A real company will not ask for it.
- Be wary of unexpected prompts. If you did not try to log in, deny it and change your password.
- Do not approve prompts just to make them stop.
A note
Setup steps differ between apps and sites. Follow the instructions in each service’s own help pages.