- Your phone
- Your account passwords
- Somewhere safe to write down backup codes
Start with your main email account
Whoever controls your email can reset most of your other passwords, so protect it first. Two-step verification (also called 2-step, two-factor or 2FA) means a sign-in needs your password plus something only you have, like your phone.
Google account
Go to myaccount.google.com, choose Security (sometimes “Security & sign-in”), then 2-Step Verification and follow the steps. Google can send a prompt to your phone, and you can add an authenticator app or a passkey too.
Apple Account (formerly Apple ID)
Most Apple Accounts already have two-factor authentication on. To check on an iPhone, open Settings, tap your name, then Sign-In & Security, and look for Two-Factor Authentication: On. Make sure your trusted phone number is current.
Microsoft account
Sign in at account.microsoft.com/security, choose Manage how I sign in, then under additional security select Two-step verification and Turn on. The free Microsoft Authenticator app is one option for approving sign-ins.
Save your backup codes
If you're offered backup or recovery codes, print them or write them down and keep them somewhere safe at home. They get you back in if you lose your phone.
💡 Tip: an authenticator app or passkey is safer than text-message codes, but a text code is still much better than nothing.Never share a code
A real company will never call or text to ask you to read back a sign-in code. If someone asks, it's a scam: hang up.
Learn the why in Passwords, passkeys and 2FA, explained, then set up a password manager.
Protecting your bank and payment apps too? Read Two-step sign-in for bank and payment accounts (and never share a code).
Related game: Password Strength Challenge. Related explainer: Passwords, passkeys and 2FA, explained .