How to Set Up Two-Factor Authentication (2FA): Step-by-Step for Google, Microsoft, Apple and More

To set up two-factor authentication (2FA), open the account's security settings, find "2-step verification", "two-factor authentication" or "multi-factor authentication", choose a second factor such as an authenticator app, passkey or security key. Then save your backup codes somewhere safe. It takes about five minutes per account.

2FA means that a stolen password on its own isn't enough to get into your account. Someone would also need your phone, your security key or your fingerprint. The UK's National Cyber Security Centre calls it one of the most effective ways to protect online accounts, because passwords are so often stolen in data breaches through no fault of the owner.

This guide explains the different types of 2FA, which to choose, step-by-step setup for the most common accounts, and how to avoid locking yourself out. Pair it with a long unique password from the password generator for each important account.

In this guide:

• What 2FA is and why it works
• Types of 2FA compared
• Before you start: a 2-minute checklist
• How to set up 2FA on a Google account
• How to set up 2FA on a Microsoft account (Outlook, Xbox, Windows)
• How to set up 2FA on Apple, Amazon and social media
• How to use an authenticator app
• Passkeys: the easiest strong option
• Backup codes and how not to lock yourself out
• 2FA scams to watch out for
• Frequently asked questions

What 2FA is and why it works

Logging in normally relies on one thing: something you know, your password. Two-factor authentication adds a second, different kind of proof:

• Something you have: your phone, a security key or a bank card reader.
• Something you are: a fingerprint or face scan, usually checked on your own device.

The names vary. Google and the NCSC say "2-step verification" (2SV), many apps say "two-factor authentication" (2FA) and businesses often say "multi-factor authentication" (MFA). For everyday purposes they mean the same thing.

The NCSC's guidance on turning on 2-step verification explains why it matters even if your password is strong. Passwords are most often stolen when an organisation that holds them is breached. Criminals then try those passwords on other sites, a technique called credential stuffing. A strong password can't stop that; a second factor can.

You also won't usually have to enter a code every time. Most services only ask for the second factor on a new device, a new browser or when something looks unusual.

Types of 2FA compared

Not all second factors are equally strong. Any 2FA is far better than none, but if you can choose, aim for the higher rows.

"Resists phishing" is the key difference. With passkeys and security keys, your device checks the real website address before signing in, so a convincing fake page simply gets nothing. With a six-digit code, you can be tricked into typing it into a fake site.

Before you start: a 2-minute checklist

1. Start with your email account. Your email can reset almost every other password, so it's the most important account to protect.
2. Install an authenticator app if you're going to use one: Google Authenticator, Microsoft Authenticator or a password manager with built-in codes all work.
3. Check your recovery phone number and email are current.
4. Have somewhere safe to keep backup codes: a password manager, or printed and stored at home.
5. Make sure your phone has a screen lock. A second factor on an unlocked phone is much weaker.

Then work through your accounts in this order: email, then banking and payment (PayPal, Amazon), then Apple or Google account, then social media, then everything else.

How to set up 2FA on a Google account

1. Go to myaccount.google.com and choose Security.
2. Under "How you sign in to Google", select 2-Step Verification and follow the prompts to turn it on.
3. Add at least two methods. Good choices are Passkeys and security keys and Authenticator. Google prompts on your Android phone or iPhone are also convenient.
4. Open Backup codes, generate the 10 single-use codes and store them safely.
5. Sign out of a browser and sign back in to check it works.

Google may already prompt you on your phone when you sign in. If so, check the device list under Security so you know which phones can approve sign-ins, and remove any you no longer use.

How to set up 2FA on a Microsoft account (Outlook, Xbox, Windows)

1. Go to account.microsoft.com and choose Security.
2. Open Advanced security options (sometimes shown as "Manage how I sign in").
3. Under "Two-step verification", choose Turn on and follow the steps.
4. Add the Microsoft Authenticator app, a passkey or a security key as a sign-in method.
5. Save the recovery code Microsoft shows you. It's a single code that can get you back in if you lose everything else.

Microsoft also lets you go fully passwordless, signing in with Authenticator or a passkey only. That's a strong option once you're confident your recovery details are right.

How to set up 2FA on Apple, Amazon and social media

Menu names change from time to time. If you can't find the option, search the app's settings for "two-factor" or "2-step", or check the service's help pages. The NCSC guide linked above also keeps a list of setup links for major services.

How to use an authenticator app

Authenticator apps generate time-based one-time passwords (TOTP). Setting one up for any site follows the same pattern:

1. In the website's security settings, choose Authenticator app. It shows a QR code.
2. Open your authenticator app, tap + or Add account, and scan the QR code.
3. The app now shows a 6-digit code for that site, refreshing every 30 seconds.
4. Type the current code into the website to confirm.
5. Save the backup codes the site offers.

If you can't scan, most sites offer a text "setup key" you can type in instead. Treat that key like a password: anyone who has it can generate your codes.

Codes depend on the time, so if they're rejected, check your phone's clock is set automatically. A phone that's a minute or two off can produce codes the site won't accept.

Consider an authenticator that backs up or syncs, such as one built into your password manager, so a lost phone doesn't mean losing every code at once.

Passkeys: the easiest strong option

A passkey replaces the password and the code with a single step: your phone or computer asks for your fingerprint, face or device PIN, then signs you in. There's nothing to type, nothing to phish and nothing for a breached website to leak.

To add one, look for Passkeys in a service's security settings and choose Create a passkey. Your device stores it, often syncing it through iCloud Keychain, Google Password Manager or a password manager.

Passkeys are now supported by Google, Microsoft, Apple, Amazon, PayPal and many others. If you're weighing them up, our guide to whether passkeys are safe covers the common worries, including what happens if you lose your phone.

Backup codes and how not to lock yourself out

The most common 2FA problem isn't hacking; it's people locking themselves out after losing or replacing a phone. Prevent it with these steps:

• Save backup codes for every account as soon as you turn on 2FA. Each code works once.
• Add more than one method, for example a passkey and an authenticator app, or two security keys.
• Move your authenticator before wiping an old phone. Most apps have a transfer or export option.
• Keep your recovery phone number current, especially after changing networks.
• Don't rely on SMS abroad if your plan doesn't receive texts when roaming.

If you do get locked out, use the service's official account recovery page. Recovery can take days by design, because it's exactly what an attacker would try. Never trust someone who contacts you offering to "recover" your account for a fee.

2FA scams to watch out for

Criminals know 2FA stops them, so they try to get you to hand over the second factor:

• "Read me the code we just sent." No genuine company, bank or police officer will ever ask for a 2FA code. Anyone who asks is the attacker.
• Unexpected approval prompts. If your phone asks "Are you trying to sign in?" and you aren't, tap No and change your password, because someone has it.
• Fake login pages. A phishing email links to a copy of a real site that asks for your password and then your code. Passkeys and security keys defeat this; codes don't.
• SIM-swap fraud. A criminal persuades your mobile network to move your number to their SIM. Ask your network about extra account security, and move important accounts off SMS where you can.

Our guide to spotting phishing emails walks through the warning signs in detail.

Frequently asked questions

How do I set up two-factor authentication?

Open the account's security settings, look for two-factor authentication, 2-step verification or multi-factor authentication, choose a method such as an authenticator app, passkey or security key, and save the backup codes. It usually takes about five minutes.

Is 2FA the same as 2-step verification and MFA?

For everyday use, yes. Two-factor authentication, 2-step verification and multi-factor authentication all mean adding a second check on top of your password. The NCSC uses the term 2-step verification.

Which type of 2FA is the most secure?

Passkeys and hardware security keys are the strongest because they resist phishing. Authenticator apps are next, then push prompts with number matching. SMS and email codes are weaker but still much better than no 2FA.

Is SMS two-factor authentication safe?

It is far better than a password alone, but it can be undermined by SIM-swap fraud and phishing. Use an authenticator app, passkey or security key for your most important accounts if the service offers one.

What happens if I lose my phone with my authenticator app?

Sign in with a backup code or another method you set up, such as a passkey or security key, then set up the authenticator again on your new phone. If you have no backup, use the service's official account recovery process.

Which accounts should I protect with 2FA first?

Start with your main email account, because it can reset most other passwords. Then protect banking and payment accounts, your Apple or Google account, and social media.

Can 2FA be hacked?

Attackers can sometimes trick people into revealing codes or approving prompts, or use SIM-swap fraud against SMS. Phishing-resistant methods such as passkeys and security keys block the most common attacks.

Will I need to enter a code every time I log in?

Usually not. Most services only ask for the second factor on a new device, new browser or when sign-in activity looks unusual, and remember trusted devices after that.

Last checked: 20 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.