A password alone is a weak lock: it can be guessed, reused on another site or stolen in a data breach. Two-factor authentication, often shortened to 2FA, adds a second check when you sign in, so a stolen password is not enough to get into your account. Setting it up takes a few minutes per account, and it is one of the most effective security steps you can take.
Start with the accounts that matter most
You do not need to secure everything at once. Begin with the accounts that would cause the most damage if someone took them over:
- Your main email account. It is the key to every password reset, so protect it first.
- Your password manager, if you use one.
- Banking, payment and shopping accounts that store card details.
- Cloud storage and phone or computer accounts that hold your files and backups.
- Social media accounts that other people trust, since attackers use them to scam your contacts.
Choose a method
Services usually offer several ways to do the second check. From stronger to more basic:
- Security keys or passkeys. A physical key or a device-based passkey is the most resistant to phishing, where the service supports it.
- Authenticator apps. An app on your phone generates a short code that changes every few seconds. It is a strong, widely supported choice.
- Text messages (SMS). Better than nothing, but codes can be intercepted or redirected through SIM swapping. Use it only when nothing else is available.
How to turn it on
The wording differs from service to service, but the steps are very similar:
- Sign in to the account and open its Security or Account settings.
- Look for an option called two-factor authentication, two-step verification or multi-factor authentication, and choose to enable it.
- Pick your method. For an authenticator app, scan the QR code the service shows with the app, then type the code the app displays to confirm.
- Save the backup codes or recovery options the service gives you, and store them somewhere safe and separate from your phone.
- Test it by signing out and signing back in.
Avoid locking yourself out
The biggest risk of two-factor authentication is losing access to your second factor. Keep your backup codes safe, add a second method where the service allows it, and make sure your recovery email and phone number are up to date. If you change phones, move your authenticator app accounts before you wipe the old device, or check how your app lets you transfer or back up its data.
Never share your codes
A verification code is for you only. No genuine company, bank or support team will ask you to read it out or send it to them. If someone asks, it is a scam, even if the message looks official. Our guide on spotting a phishing email explains how to recognize these attempts.
