How to Set Up Two-Factor Authentication the Right Way

Two-factor authentication (2FA) means logging in needs two things: something you know (your password) and something you have (your phone, a security key). If someone steals your password, they still can't get in.

It's one of the most effective things you can do for your online security, and it takes about five minutes per account. Here's how to do it without locking yourself out.

The four kinds of 2FA, from weakest to strongest

Text message (SMS) codes

You get a 6-digit code by text. It's much better than nothing, but it's the weakest option. Attackers can sometimes trick a phone company into moving your number to their SIM card (a "SIM swap"), and then they receive your codes.

Use SMS only when a site offers nothing better.

Authenticator apps

An app on your phone generates a new 6-digit code every 30 seconds. Nothing is sent over the phone network, so SIM swaps don't matter.

Good free options: Google Authenticator, Microsoft Authenticator, and the authenticator built into many password managers. Bitwarden includes one with Premium, for example. We compare password managers in The Best Password Manager for Most People.

Passkeys

Passkeys replace the password entirely. You log in with your fingerprint, face or phone PIN, and there's nothing for a phishing site to steal. More and more big services support them: Google, Apple, Microsoft, Amazon, GitHub and many banks.

If a site offers a passkey, take it. It's both easier and safer.

Hardware security keys

A small USB or NFC key (like a YubiKey) that you tap to log in. This is the strongest option, and it's what security-conscious people use for their most important accounts. You'll want two: one to use, one as a spare.

Which accounts to protect first

Don't try to do everything today. Start with the accounts that unlock all the others:

1. Your main email. Whoever controls your email can reset every other password.
2. Your password manager.
3. Your bank and payment apps.
4. Apple ID or Google account. These control your phone, photos and backups.
5. Social media, especially anything tied to a business.

How to turn it on

Every site is slightly different, but the path is nearly always:

Settings → Security (or "Login and security") → Two-factor authentication / 2-step verification

Then scan the QR code with your authenticator app, type in the 6-digit code it shows, and you're set.

The step everyone forgets: recovery codes

When you set up 2FA, most sites give you a list of backup or recovery codes. These let you in if you lose your phone.

Save them. Print them and put them with your important papers, or store them in your password manager. Don't keep them only on the phone you're protecting.

People who skip this step are the ones posting desperate "locked out of my account, please help" messages a year later.

What if I get a new phone?

Before you wipe or trade in the old phone, move your authenticator codes:

• Google Authenticator and Microsoft Authenticator can back up or transfer codes to a new phone. Check this is switched on now, not on moving day.
• Password-manager authenticators sync automatically.
• Passkeys sync through your Apple, Google or password manager account.

The five-minute checklist

1. Install an authenticator app (or use your password manager's).
2. Turn on 2FA for your main email, using the app, not SMS.
3. Save the recovery codes somewhere safe and offline.
4. Add a passkey wherever you see the option.
5. Repeat for your bank, password manager and Apple or Google account this week.

That's it. You're now much harder to hack than most people online.