Search guides

Enable two-factor authentication

We'll set up 2FA on your email, banking, and social accounts using an authenticator app or hardware key—and save backup codes so you never get locked out.

How-to · Security basics
20–40 min
What you'll need
  • Smartphone or computer
  • Authenticator app (Google Authenticator, Authy, Microsoft Authenticator) or FIDO2 hardware key (e.g. YubiKey)
  • Access to each account you want to protect
Step 1 of 7

Quick triage — pick your path

Get started

Choose the option that matches what you see. You can jump straight to that section.

Show full guide

Steps

Goal: Install an authenticator app or connect a hardware key, then enable 2FA on your primary email first.

  • Download an authenticator app (Google Authenticator, Microsoft Authenticator, or Authy) from your device’s app store. If you prefer a hardware key, connect a FIDO2-compatible key like a YubiKey.
  • Confirm the app opens and shows an empty account list, or that your hardware key’s LED flashes when touched.
  • Proceed to Set up email first.

Set up email first

Goal: Enable 2FA on your primary email—it controls password resets for other accounts.

  • Log in to your email account and find the Security or Sign-in section in account settings. Look for “Two-step verification,” “Login verification,” or “2FA.”
  • Click the option to add an authenticator app or security key. A QR code will appear.
  • Open your authenticator app and scan the code. If using a hardware key, select the security-key option and tap the key when prompted.
  • Type the six-digit code from the app into the service’s confirmation field. If the code is rejected, check that your phone’s clock is synced to network time—TOTP codes depend on accurate time.
  • Good: The service shows 2FA as enabled. Proceed to Save backup codes.
  • Bad: Code rejected—sync your phone’s clock to network time and try again.

Save backup codes

Goal: Store backup codes offline so you can regain access if you lose your device.

  • After enabling 2FA, the service will offer a set of one-time backup codes. Copy or print them.
  • Store the codes in a secure physical location—a safe or locked drawer. Do not store them in a cloud note or on the same device as your authenticator.
  • Verify you have recorded all codes before closing the dialog. These are the only way to regain access if you lose your phone and hardware key.

Repeat for banking and social

Goal: Enable 2FA on banking, financial, and social media accounts.

  • Open the security settings of your bank, investment, and payment accounts one at a time. If a service only supports SMS-based 2FA, enable it—SMS is weaker but still better than no second factor.
  • Go to the security settings of each social media platform (Facebook, X, Instagram, LinkedIn). Prefer authenticator apps over SMS when available.
  • Confirm each account shows 2FA as active in its security summary. You should see a green checkmark or “Enabled” label.

Test the login flow

Goal: Verify 2FA works and you can log in with your second factor.

  • Log out of one account and log back in. The 2FA prompt should appear.
  • Open your authenticator app and enter the current six-digit code. If you set up a hardware key, tap it when the browser prompts you.
  • Good: You reach your account dashboard. 2FA is working.
  • Bad: Code rejected—check clock sync, or use a backup code if you have one.

When to get help

If you lose access to your authenticator and backup codes, contact each service’s account-recovery flow. Recovery can take days. Never share backup codes or 2FA codes with anyone—legitimate support will never ask for them.

References

Verification

  • Log out and back in to at least two accounts. The 2FA prompt should appear each time.
  • Your authenticator app shows entries for every account you enabled.
  • Your backup codes are stored in a secure offline location separate from your devices.
  • Every account you enabled 2FA on now requires the second factor at login.

Do you have an authenticator app or hardware key?

Download Google Authenticator, Authy, or Microsoft Authenticator. Or use a [FIDO2](#term-fido2) hardware key like YubiKey.

Download an authenticator app from your device's app store, or connect a FIDO2-compatible hardware key. Confirm the app opens and shows an empty account list, or the key's LED flashes when touched. Good: you have an app or key. Bad: need to install—see install step.

Yes No

You can change your answer later.

Install authenticator app or hardware key

Download Google Authenticator, Microsoft Authenticator, or Authy from your app store. Or connect a FIDO2 hardware key (e.g. YubiKey) to your computer or phone. Prefer app or hardware key over SMS—they are more secure.

Done

Have you enabled 2FA on your primary email?

Start with email—it controls password resets for other accounts. Find Security or Sign-in in account settings.

Log in to your email. Find Security or Sign-in in account settings. Look for "Two-step verification" or "2FA." Click to add an authenticator app or security key. Scan the QR code with your app, or tap the hardware key when prompted. Enter the six-digit code. If the code is rejected, sync your phone's clock to network time—TOTP codes depend on accurate time. Good: 2FA enabled on email. Bad: code rejected—check clock sync.

Yes No

You can change your answer later.

Set up 2FA on email

Log in to your email. Go to Security or Sign-in settings. Add authenticator app or security key. Scan the QR code or tap the key. Enter the verification code. Sync your phone clock to network time if codes are rejected.

Done

Did you save the backup codes?

After enabling 2FA, the service offers one-time [backup codes](#term-backup-codes). Store them offline—they are the only way to regain access if you lose your device.

After enabling 2FA, the service will offer backup codes. Copy or print them and store in a secure physical location (safe or locked drawer). Verify you have recorded all codes before closing the dialog. Good: codes saved. Bad: did not save—go back and save them before closing; you may need to disable and re-enable 2FA to get new codes.

Yes No

You can change your answer later.

Save backup codes

Copy or print the backup codes. Store them in a secure physical location. Never store them in a cloud note or on the same device as your authenticator. These are the only way to regain access if you lose your phone and hardware key.

Done

2FA is set up on email

You have 2FA on your primary email. Repeat for banking and financial accounts, then social media. If a service only supports SMS, enable it—SMS is weaker but better than nothing. Test the login flow: log out and log back in to confirm the 2FA prompt works. See How to recover a locked account if you ever get locked out.

Done

Reviewed by Blackbox Atlas

Frequently asked questions

Is an authenticator app better than SMS for 2FA?
Yes. Authenticator apps (Google Authenticator, Authy) and hardware keys are more secure than SMS—SMS can be intercepted via SIM swapping. Use an app or hardware key when available; enable SMS if it's the only option.
What happens if I lose my phone with the authenticator app?
Use your backup codes to regain access, then set up 2FA again on a new device. Store backup codes in a safe physical location. Some apps like Authy sync across devices if you set that up in advance.
Which accounts should have 2FA first?
Start with email (it controls password resets for other accounts), then banking and financial accounts, then cloud storage and social media. Any account that holds sensitive data or can be used to reset other passwords.

Rate this guide

Was this helpful?

Continue to