How to Set Up Two-Factor Authentication (and Which Method to Pick)
A second sign-in step stops most account takeovers. Here's which method to use and exactly where to switch it on for your Google, Apple and Microsoft accounts.
To set up two-factor authentication (2FA), open the security settings of each important account, turn on the second step, and choose the strongest method it offers: a passkey or security key first, an authenticator app second, and SMS codes only if nothing else is available. Then save your backup codes somewhere safe so you can’t lock yourself out.
Start with the accounts that unlock everything else: your email, your Apple, Google or Microsoft account, your bank and your password manager. The steps for the big three are below.
What two-factor authentication actually does
A password is something you know. Two-factor authentication adds something you have (your phone or a hardware key) or something you are (your fingerprint or face). If someone steals or guesses your password, they still can’t get in without that second factor.
You’ll also see the terms 2-Step Verification (Google’s name) and multi-factor authentication (MFA). For everyday purposes they mean the same thing.
2FA methods compared: SMS vs apps vs passkeys vs security keys
Not all second factors are equally strong. The main difference is whether a fake login page can trick you into handing the code over.
| Method | How it works | Phishing-resistant? | Best for |
|---|---|---|---|
| SMS / voice code | A one-time code is texted or read to your phone number | No. Codes can be phished, and numbers can be hijacked through SIM-swap scams | A fallback when nothing else is offered |
| Authenticator app | An app (Google Authenticator, Microsoft Authenticator and similar) generates a new 6-digit code every 30 seconds | Partly. No SIM-swap risk, but you can still type a code into a fake site | Most sites that don’t support passkeys yet |
| Push prompt | Your phone shows “Is this you signing in?” and you tap Yes | Partly. Number-matching prompts help, but people can approve a prompt by mistake | Google and Microsoft accounts |
| Passkey | Your device signs you in with your fingerprint, face or screen lock; nothing to type | Yes. A passkey only works on the real website it was created for | Google, Apple, Microsoft and a growing list of other sites |
| Hardware security key | A small USB-C, Lightning or NFC key you plug in or tap | Yes | High-risk accounts, journalists, admins, anyone wanting maximum protection |
Any second factor is far better than none. If a site only offers SMS, turn it on anyway, then switch to something stronger when it becomes available.
How to turn on 2-Step Verification for a Google account
- Go to myaccount.google.com and sign in (on Android, you can also open Settings > Google > Manage your Google Account).
- Open Security & sign-in (older versions of the page just say Security).
- Under How you sign in to Google, select 2-Step Verification and follow the prompts to turn it on.
- Add at least two second steps. Good choices are Google prompts on your phone, an Authenticator app and a security key. A phone number works as a backup.
- Back on the Security & sign-in page, open Passkeys and security keys and select Create a passkey so you can sign in with your fingerprint or face.
- Open Backup codes, select Get backup codes, and print or store them (Google gives you a set of 8-digit, single-use codes).
Google notes that a newly added phone number can take up to 7 days to become fully trusted. Its official guide is on Google Account Help. Work and school accounts are managed by an administrator, so the options may look different or be locked.
How to check two-factor authentication on an Apple account
Most Apple Accounts created in recent years have two-factor authentication on by default, and once it’s on for a while it can’t be switched off. To check or turn it on:
- On an iPhone or iPad, open Settings and tap your name at the top.
- Tap Sign-In & Security (called Password & Security on older iOS versions).
- Look for Two-Factor Authentication: On. If it says Off, tap Turn On Two-Factor Authentication and follow the prompts.
- Under Trusted Phone Numbers, add a second number you control, such as a partner’s or a work phone.
On a Mac, the same options live under System Settings > [your name] > Sign-In & Security.
Optional: security keys and a Recovery Key
In the same Sign-In & Security screen you can add Security Keys (Apple requires at least two FIDO-certified keys so you have a spare) or set up a Recovery Key. Both make your account harder to steal, but they also mean Apple can’t easily help you recover access if you lose them. Only turn them on if you’ll keep the keys or recovery code safe.
How to turn on two-step verification for a Microsoft account
- Go to account.microsoft.com and sign in.
- Select Security, then open the sign-in or advanced security options (Microsoft labels this Manage how I sign in on current versions of the page).
- Find Two-step verification and select Turn on.
- Follow the setup wizard. Installing the Microsoft Authenticator app gives you push approvals and one-time codes.
- Save the recovery code Microsoft shows you. It’s the key to getting back in if you lose your phone.
- Add a passkey from the same page so you can sign in with Windows Hello or your phone instead of a password.
Microsoft also lets you go fully passwordless, removing the password from your account entirely. Set up the Authenticator app or a passkey on two devices before you do that.
Backup codes: don’t skip this step
The most common 2FA problem isn’t hackers. It’s people getting locked out after losing or replacing a phone. Protect yourself:
- Save backup or recovery codes for every account. Store them in a password manager, or print them and keep the paper with important documents.
- Add more than one second factor, such as a passkey on your phone plus one on your laptop, or two security keys.
- Move your authenticator app properly when you change phones. Google Authenticator and Microsoft Authenticator both offer account sync or transfer; check it works before wiping the old phone.
- Keep your recovery phone number and email current.
Watch out for 2FA scams
Attackers know 2FA blocks them, so they try to get you to hand over the second step. Never read a verification code to anyone who calls or texts you, even if they claim to be from your bank, Google or Apple; real companies don’t ask for it. Learn the common patterns in our guide to spotting scam text messages. If you get a sign-in prompt you didn’t trigger, tap No or Deny, then change your password. That prompt means someone already has it.
Bottom line
Turn on two-factor authentication today for your email, phone account, bank and password manager. Use passkeys or security keys where you can, an authenticator app where you can’t, and SMS only as a last resort. Save your backup codes before you need them.
FAQ
Is SMS two-factor authentication still worth using?
Yes, if it’s the only option. It stops most password-only attacks. It’s weaker than apps and passkeys because codes can be phished and phone numbers can be stolen through SIM swaps.
Are passkeys the same as two-factor authentication?
Not exactly, but they cover the same ground. A passkey combines something you have (your device) with your fingerprint, face or PIN, so it counts as strong multi-factor sign-in on its own and can’t be phished like a code.
What happens if I lose my phone?
Sign in with a backup code, a security key, a passkey on another device or a backup phone number. If you have none of those, use the account’s recovery process, which can take days.
Do I need a separate authenticator app for every site?
No. One authenticator app can hold codes for many accounts. Many password managers can also store one-time codes.
