How to Set Up Two-Factor Authentication (and Which Type to Choose)
A plain-English guide to two-factor authentication: SMS codes, authenticator apps, security keys and passkeys, which accounts to protect first, and how to avoid lockouts.
A password on its own is one lock on your door. Two-factor authentication (2FA) adds a second lock: even if someone steals or guesses your password, they still cannot get in without the second factor. It is one of the most effective security steps you can take, and it takes a few minutes per account.
The types of 2FA, from weakest to strongest
| Type | How it works | Notes |
|---|---|---|
| SMS code | A code is texted to your phone | Better than nothing, but vulnerable to SIM-swap and interception |
| Authenticator app | An app generates a code that changes every 30 seconds | Works offline, much harder to intercept |
| Security key | A physical USB or NFC key you tap or plug in | Strongest against phishing |
| Passkey | A cryptographic key on your device, unlocked by biometrics or PIN | Phishing-resistant and fast; supported by a growing number of services |
Which accounts to protect first
Start with the accounts that can be used to reset all the others:
- Your main email account. Anyone who controls your email can reset your other passwords.
- Your password manager.
- Your Apple, Google or Microsoft account.
- Banking, investment and payment accounts.
- Social media, shopping and cloud storage accounts.
How to turn it on
The exact menus differ, but the steps are the same almost everywhere:
- Sign in and open Security or Account settings.
- Look for Two-factor authentication, 2-step verification or Passkeys.
- Choose your method. Pick an authenticator app, passkey or security key if offered; otherwise SMS.
- If using an authenticator app, scan the QR code on screen with the app, then type the six-digit code to confirm.
- Save the backup codes. Print them or store them in your password manager, never only on the phone you are protecting.
- Add a second method if the service allows it, such as a second key or a phone number as a fallback.
Avoid getting locked out
- Keep backup codes somewhere separate from your phone.
- When you get a new phone, move your authenticator app accounts before wiping the old phone. Some apps support encrypted backup or transfer.
- Make sure your recovery email address is one you still control.
- Register two security keys if you use them, and keep one in a safe place.
A warning about “code requests” you did not make
If you receive a verification code you did not ask for, someone is trying to sign in with your password. Do not share the code with anyone, even someone claiming to be the company’s support. Change the password for that account straight away.
Frequently asked questions
Is SMS two-factor authentication safe enough?
It is much better than a password alone, but it is the weakest common option because phone numbers can be hijacked through SIM-swap scams. Use an authenticator app, passkey or security key where you can.
What happens if I lose my phone?
That is why you save backup codes when you set up two-factor authentication. Store them somewhere safe and offline, and know your account's recovery process before you need it.
Are passkeys the same as two-factor authentication?
Not exactly. A passkey replaces your password with a cryptographic key stored on your device, unlocked by your fingerprint, face or PIN. It is resistant to phishing, and many services treat it as stronger than a password plus a code.
