What is two-factor authentication, and how do you turn it on?
Two-factor authentication (2FA) means an account asks for a second proof of identity after your password, such as a code from your phone or a tap on a security key. If someone steals your password, they still can't sign in without that second factor. You turn it on in each account's security settings.
The short version
- 2FA combines two of three kinds of proof: something you know, something you have and something you are.
- Common second factors are text message codes, authenticator app codes, sign-in prompts on your phone, security keys and passkeys.
- CISA says "any MFA is better than no MFA." Google recommends passkeys and hardware security keys to increase phishing protection.
- Look for the setting under your account's security options. Services call it two-factor authentication, 2-Step Verification or two-step verification.
- Save backup codes or a second method before you need them, so a lost phone doesn't lock you out.
What is two-factor authentication?
Two-factor authentication is a sign-in that needs two different kinds of proof. NIST, the US standards agency, names three authentication factors, and the Cybersecurity and Infrastructure Security Agency (CISA) gives examples of each:
- Something you know: a password or a PIN.
- Something you have: an authentication app or a confirmation text on your phone.
- Something you are: a fingerprint or a face scan.
A stolen password alone isn't enough to get in. The UK's National Cyber Security Centre (NCSC) says 2-step verification "helps to keep cyber criminals out of your accounts, even if they know your passwords." CISA says MFA "can make us significantly safer online."
Once it's on, you won't always be asked for the second step. Apple says you generally won't be asked for a code again on a device you've already signed in on, unless you sign out completely, erase the device or change your password for security reasons. Google lets you skip the second step on a computer you use often, but advises doing this only on devices you don't share.
Two-factor authentication vs MFA vs two-step verification
These terms overlap, and companies use them loosely.
- Multi-factor authentication (MFA) is the umbrella term. NIST defines it as authentication using two or more factors. Two-factor authentication is MFA with exactly two.
- Two-step verification is the name Google ("2-Step Verification") and Microsoft use for their versions. Microsoft says two-step verification is sometimes called multi-factor authentication.
- Two-factor authentication is the name Apple uses for Apple Account protection.
The NCSC treats the names as interchangeable: it says 2-step verification is also called two-factor authentication (2FA) and multi-factor authentication (MFA).
For an ordinary account holder, the difference rarely matters. All three add a second check after the password.
Which 2FA method is safest?
Not every second factor offers the same protection. Here's how the common methods compare, based on what CISA and Google say:
| Method | How it works | What the sources say |
|---|---|---|
| Text message or voice call | A code is sent to your phone number | Google says codes sent by text or call can be vulnerable to phone number-based hacks. |
| Email code | A code is sent to your email address | CISA lists a numeric code by text or email as one MFA option. |
| Authenticator app | An app on your phone generates a short-lived code | CISA says these apps generate a new code every 30 seconds. Google says its Authenticator app works without an internet connection or mobile service. |
| Sign-in prompt | Your phone asks whether you're trying to sign in | Google prompts let you tap Yes to allow a sign-in you requested or No to block one you didn't. |
| Security key or passkey | A physical key or your device confirms the sign-in | CISA says the only widely available phishing-resistant authentication is FIDO/WebAuthn. Google recommends passkeys and hardware security keys for increased phishing protection. |
In practice, use the strongest method each account offers, and don't skip 2FA because only text codes are available. A text code still blocks an attacker who has only your password.
Watch for changes: Microsoft says it will start phasing out SMS as a method of authentication and account recovery for personal Microsoft accounts. If you rely on text codes there, consider adding another method, such as the Microsoft Authenticator app.
How to turn on two-factor authentication
CISA's general advice works for almost any account: look for settings under your account profile, then open the security settings. The option may be called two-factor authentication, two-step authentication or something similar. Then pick a method from the options the account offers.
Here are the steps for three common accounts, according to each company's help pages. Set up a backup option at the same time, as the section on backup codes below explains.
Google Account
- Go to myaccount.google.com and sign in.
- Tap Security & sign-in.
- Under "How you sign in to Google," select Turn on 2-Step Verification.
- Follow the on-screen steps.
To use Google Authenticator as your second step on Android, Google says to open your 2-Step Verification settings and tap Set up authenticator (some devices show Get Started). Google says Authenticator can take up to 7 days to appear as a sign-in option.
Apple Account on iPhone
- Open Settings and tap your name.
- Tap Sign-In & Security.
- Turn on two-factor authentication and follow the onscreen steps.
When you later sign in on a new device or on the web, Apple shows the verification code automatically on your trusted devices. If you can't reach them, choose Didn't Get a Code? or Can't get to your devices? on the code screen to get the code by text or phone call to your trusted phone number.
Microsoft account
- Sign in at account.microsoft.com/security.
- Select Manage how I sign in.
- Under Additional security and Two-step verification, choose Turn on.
- Follow the instructions on the screen.
Some apps and devices can't use regular security codes. Microsoft's examples are the mail apps on some phones and the Xbox 360. For those, Microsoft says to use an app password, which is available only once two-step verification is on.
Social media, gaming and other accounts
The setting is usually in the same place: your profile, then the security settings. The NCSC suggests starting with your most important accounts, such as email, banking, social media and online shopping. Check each service's help pages to see which methods it supports.
Backup codes: what to do if you lose your phone
2FA works because the second factor is hard to get. That also means losing your phone can lock you out, so plan ahead.
- Google lets you print or download a set of 10 backup codes, each 8 digits long. Each code works once, and you can make a new set whenever you want. To use one, click Try another way at sign-in, then Enter one of your 8-digit backup codes. Don't share them with anyone.
- Apple says you can add more trusted phone numbers so you have another way to get a code.
- Microsoft says that with two-step verification on, you'll always need two forms of identification, and it strongly recommends keeping three pieces of security info on file. If you lose access to your contact methods, Microsoft warns that regaining access can take 30 days, and you could lose the account.
If you use Google Authenticator, signing in to it with your Google Account syncs your codes across devices, so a new phone picks them up. Without that, Google's app has a Transfer codes option to move them from the old phone with a QR code.
Frequently asked questions
Is two-factor authentication safe?
Yes. CISA says it makes account takeover much harder, even when a password is compromised. The main caveat is text message codes, which Google says can be vulnerable to phone number-based hacks, so pick another method when an account offers one.
Can two-factor authentication be hacked?
Some methods are weaker than others, as the text code caveat above shows. CISA says "any MFA is better than no MFA," but that the only widely available phishing-resistant authentication is FIDO/WebAuthn, which blocks login attempts on fake websites. The FIDO Alliance says passkeys are built on these FIDO standards.
Can two-factor authentication be turned off?
Often, yes. Microsoft has a Turn off option in the same place you turned it on. Apple is stricter. If your Apple Account was created with two-factor authentication, Apple says the protection can't be removed. If you turned it on recently, Apple says you can lower your account security within two weeks of enrolling.
What is the best two-factor authentication app?
Use the authenticator app the account recommends, or any app that supports standard verification codes. Google Authenticator and Microsoft Authenticator are the companies' own apps. Google says its app can sync codes to your Google Account, which helps when you replace your phone.
Two-factor authentication vs passkey: which is better?
A passkey combines both factors in one step: the device you have and the fingerprint, face or PIN you use to open it. Google says signing in with a passkey bypasses the second step of 2-Step Verification. Our guide to what a passkey is explains how they work and how to set one up.
2FA protects your accounts, but your devices need protecting too. If you're on an older Windows PC, see our guide to whether Microsoft Defender is enough.