How to set up two-factor authentication
Set up two-factor authentication by opening an account's security settings, choosing two-step or two-factor sign-in, and adding a second step: an authenticator app, a passkey or a hardware key is stronger than a text message code. Start with your main email, because it can reset everything else, then banking, your phone account and social media. Save the backup codes somewhere safe.
Why it matters: A second sign-in step stops most account takeovers even when a password leaks.
Steps
- Install an authenticator app from your phone's official app store, or check whether your phone supports passkeys.
- Open your main email account's security settings and find two-step or two-factor sign-in.
- Choose the authenticator app or passkey option and follow the prompts.
- Save the backup codes it offers: print them or store them in your password manager.
- Repeat for banking, your cell phone account, cloud storage and social media, in that order.
- Keep text message codes only as a fallback where nothing stronger is offered.
- Test signing in once on another device so you know the process before you need it.
Common mistakes
- Starting with a minor account and never getting to email.
- Skipping the backup codes, then getting locked out with a lost phone.
- Approving a sign-in prompt you did not start; deny it and change your password.
Teach this to someone
A one page sheet for showing a friend, a teenager or a parent: what to say, what to show, and one question to check it landed.
Teach: How to set up two-factor authentication
What to say
Set up two-factor authentication by opening an account's security settings, choosing two-step or two-factor sign-in, and adding a second step: an authenticator app, a passkey or a hardware key is stronger than a text message code. Start with your main email, because it can reset everything else, then banking, your phone account and social media. Save the backup codes somewhere safe.
What to show
- Install an authenticator app from your phone's official app store, or check whether your phone supports passkeys.
- Open your main email account's security settings and find two-step or two-factor sign-in.
- Choose the authenticator app or passkey option and follow the prompts.
- Save the backup codes it offers: print them or store them in your password manager.
- Repeat for banking, your cell phone account, cloud storage and social media, in that order.
- Keep text message codes only as a fallback where nothing stronger is offered.
- Test signing in once on another device so you know the process before you need it.
Check question
Which account should get two-factor sign-in first?
Answer: Your main email. Email can reset most other accounts, so it is the key to everything.
Your checklist
Saved only in this browser.
Quick quiz
Three questions. Your score is saved only in this browser.
Related skills
Sources
- US national cybersecurity guidance for individuals, 2026. Reviewed September 28, 2026.
Written in our own words from the sources above. It is general information, not advice for your situation; where a professional, your doctor or your lease says something different, follow them.
Last reviewed . First published .