What is two-step verification and how do you turn it on?
Short answer
Two-step verification adds a second proof (a code, prompt or key) on top of your password when you sign in. You enable it in your account's security settings, and it protects you even if your password is stolen.
Checklist
- Enabled it on my email account
- Chose an app or security key where possible
- Saved backup codes in a safe place
- Will not share my code with anyone
Two-step verification (2FA) is a sign-in method that asks for a second check in addition to your password. Even if your password leaks or is guessed, an attacker must also get past the second step.
How does it work?
Verification relies on three kinds of proof: something you know (a password), something you have (a phone, a security key) and something you are (a fingerprint, your face). Two-step verification combines at least two of them.
Main methods
- Authenticator app: Authenticator-type apps generate codes that change at regular intervals. They are generally safer than SMS.
- Security key: Physical keys that work over USB, NFC or Bluetooth are among the options most resistant to phishing.
- App prompt: An "Is this you?" approval sent to your phone. It is convenient, but never approve a request you did not make.
- SMS code: Easy, but exposed to risks such as SIM swapping. Better than nothing; prefer the other methods when possible.
How to turn it on in general
- Open your account settingsFind the "Security" or "Privacy and security" section.
- Choose two-step verificationIt may be called "Two-step verification", "2-Step Verification" or "Multi-factor authentication".
- Pick a methodChoose an option such as an authenticator app or a security key; for an app, scan the QR code on the screen.
- Confirm with a codeEnter the code the app gives you to finish setup.
- Save the backup codesKeep the backup codes somewhere safe so you can still get in if you lose your phone.
Frequently asked questions
What if I lose my phone?
You can sign in with backup codes or a second registered method. That is why preparing backups during setup matters.
Does two-step verification fully protect my account?
No. It reduces risk significantly, but fake login pages and code sharing can still defeat it. Stay alert.
What should I do when switching to a new phone?
While your old device is still with you, move the authenticator app to the new one or set it up again on each account; then remove the old device.
Have a question or spotted a mistake?
Write your question or the error you noticed; our editors will review it. Messages are not published.