You can protect your most important accounts with two-factor authentication in about 45 to 60 minutes. You will add a second step to sign-in, usually a six-digit code from an authenticator app, a passkey or a physical security key, so that a stolen password is no longer enough to take over an account. You will need your phone, access to your email and a place to keep backup codes.
Apps update their menus often, so use the steps below as a guide and follow the on-screen wording if it differs. The methods described are standard and documented by the services themselves.
Before you start
Gather what you need and decide where your codes will live.
- Your phone and a computer. You will scan QR codes from your phone.
- An authenticator. Choose one: the authenticator built into a password manager, or a dedicated app. 1Password can store one-time codes, Bitwarden offers an integrated authenticator on Premium, and Proton Pass includes one in Pass Plus.
- A list of accounts. Write down your priorities: main email, password manager, bank and financial accounts, Apple or Google account, Microsoft account, social media and shopping accounts that store cards.
- A safe place for backup codes. A printed copy kept at home, or an encrypted note in your password manager.
Key point
Choose a method that does not depend on a single phone. If that phone is lost, you must still be able to get back in. Always save backup codes when a service offers them.
Which method should you use?
| Method | Security | Convenience | Notes |
|---|---|---|---|
| Security key or passkey | Highest | High | Resistant to phishing; needs a supported device |
| Authenticator app | High | Medium | Works offline and is widely supported |
| SMS code | Lower | High | Better than nothing, but can be intercepted by SIM swapping |
| Email code | Lower | High | Only as secure as that email account |
Use a passkey or security key where offered, an authenticator app elsewhere and SMS only as a last resort.
Why a second factor matters
Most account takeovers begin with a password that was reused, guessed or leaked in a breach, or captured by a fake sign-in page. Two-factor authentication means the attacker needs something else as well, such as the device in your pocket. It does not make an account invulnerable, but it turns a stolen password from a complete break-in into a dead end for most routine attacks.
There are three kinds of second factor: something you know (a password or PIN), something you have (a phone, authenticator or security key) and something you are (a fingerprint or face scan on your device). Two-factor authentication combines two different kinds. Two passwords do not count.
Choosing an authenticator app
You have two sensible routes, and either is fine.
| Option | Good for | Watch out for |
|---|---|---|
| Authenticator built into your password manager | Convenience, and easy recovery on a new device | Keeping passwords and codes together means the vault needs very strong protection |
| A separate authenticator app | Keeping passwords and codes apart for your most important accounts | You must back it up or migrate it yourself when you change phones |
Whichever you choose, look for an app that lets you back up or export your accounts in an encrypted form, since a phone that fails without a backup is the most common way people lock themselves out. A hardware security key is a third route, and the strongest for high-value accounts.
A reasonable compromise is to keep codes for everyday accounts in your password manager and use a separate app or a security key for your email, the password manager itself and your main financial accounts.
Step 1: Secure your email first
Your email account can reset almost every other password, so protect it first. Open the security settings of your email provider and look for “2-Step Verification”, “Two-step verification” or “Multi-factor authentication”. For a Google account, this is under the Security section of your account settings, and for Microsoft it is in the account’s security options.
Choose an authenticator app or passkey as your method, not SMS, if you can.
Step 2: Turn on 2FA and scan the QR code
When a service offers an authenticator app, it displays a QR code. In your authenticator, choose “add” or the plus sign, then scan the code with your phone’s camera. The app will start showing a six-digit code that changes every 30 seconds or so.
Type the current code into the website to confirm it works. If you cannot scan, most sites show a text “setup key” that you can paste into the app.
Step 3: Save your backup codes
Right after setup, most services show a set of single-use backup codes. Save them immediately. Print them or store them in your password manager’s secure notes, not in a plain file on your desktop. These codes are your safety net if your phone is lost.
Step 4: Add a second method
Where possible, register a backup, such as a second device, a security key or a trusted phone number. It means a single failure will not lock you out.
Step 5: Use passkeys and security keys where offered
Many major services now let you sign in with a passkey, which replaces your password with a cryptographic credential stored on your device or in a compatible password manager. Passkeys are resistant to phishing because they only work on the genuine site. Look for a prompt such as “Create a passkey” in the security settings and follow the instructions.
A hardware security key is a small physical device that you plug in or tap. It is the strongest option for high-value accounts, such as your main email or a business account. If you buy one, register at least two, and keep the spare somewhere safe.
Step 6: Repeat for your other priority accounts
Work through your list. A sensible order is:
- Main email accounts
- Your password manager
- Banking, payments and other financial accounts
- Apple, Google and Microsoft accounts
- Social media and shopping accounts
On Apple devices, two-factor authentication is built into the Apple Account, and you can check it in your device settings under your name and then Sign-In & Security. For social networks, look in Settings under Security or Account Centre.
Step 7: Protect your password manager itself
Your password manager is the key to everything else, so give it the strongest 2FA you can. Options vary by product, so check the security settings of 1Password, Bitwarden or Proton Pass. Our explainer on what a password manager is shows why this matters, and our guide to the best password managers compares them.
1Password
Password manager with end-to-end encryption, a Secret Key and apps for every major platform.
Individual from $2.99 per month and Families from $4.49 per month billed annually for new customers (introductory offer); 14-day free trial (October 2026)
Bitwarden
Open-source password manager with a capable free plan and low-cost premium tiers.
Free plan; Premium $19.80 per year; Families $47.88 per year for up to 6 users (billed annually, October 2026)
Proton Pass
End-to-end encrypted password manager from Proton with built-in email aliases and a free plan.
Free plan; Pass Plus $2.99 per month billed $35.88 every 12 months (October 2026)
Step 8: Test your recovery
Before you finish, try one sign-in from a private browser window to check that the code works. Then review how you would recover if you lost your phone, and confirm your backup codes are where you think they are.
Tip
Spend two minutes each year checking your recovery options and updating phone numbers and backup codes. Recovery details go stale quietly.
Common mistakes
- Starting with the least important account. Email and your password manager come first, because they unlock everything else.
- Not saving backup codes. They are the difference between a five-minute recovery and a long account-recovery process.
- Registering only one device. Add a second method so one lost phone does not lock you out.
- Relying on SMS when an app is offered. Text messages can be intercepted through SIM swapping, so use them only as a last resort.
- Approving prompts you did not expect. If a push notification arrives when you did not sign in, deny it and change your password.
- Sharing codes with support callers. A real support team will never ask you to read out a code.
- Forgetting shared accounts. If several people use one account, agree who holds the second factor and where the backup codes are kept.
Setting up 2FA for family and small teams
Do your own accounts first, so you can show others how it works. For relatives, sit with them and set up email and one banking app, then add the rest over time. For a small business, give every person their own account instead of sharing a login, require two-factor authentication on email and any admin or finance tools, and keep a documented recovery process for when someone loses a device.
A password manager with a family or team plan makes this easier, because shared recovery details and codes can live in one protected place. See our best password managers guide for options.
Passkeys and what comes next
Passkeys are gradually replacing passwords on large services. A passkey is a cryptographic credential tied to your device or stored in a compatible password manager, and it is unlocked with your fingerprint, face or device PIN. Because it only works on the genuine site, it resists phishing in a way that typed codes do not.
For now, most people will use a mix: passkeys where a service offers them, authenticator codes elsewhere and a strong password manager tying it together. Turning on two-factor authentication today does not stop you adopting passkeys later, and many services keep two-factor authentication as a fallback.
Troubleshooting
The code is rejected. Authenticator codes depend on accurate time. Make sure your phone’s date and time are set to update automatically, then try the next code.
I got a new phone. Move your authenticator accounts before you wipe the old phone. Some apps offer encrypted transfer or backup. If you did not, use your backup codes and set 2FA up again.
I lost my phone and my backup codes. Use the service’s account recovery process. It usually takes time and identity checks, so prevention is far easier.
A site only offers SMS. Turn it on anyway, since it is better than no second factor, and use a unique, strong password.
I am not receiving SMS codes. Check signal, blocked senders and whether the number on file is current.
A scam asked for my code. Never share a 2FA code with anyone who contacts you. Legitimate support teams do not ask for it. Phishing pages sometimes request codes in real time, so check the web address before you type anything.
Two-factor authentication is not a complete defence, but it blocks most routine account-takeover attempts, and the time it takes is small compared with recovering a hijacked account.
