Two-Factor Authentication Explained: What It Is and How to Turn It On

A password on its own is a single lock. If someone steals or guesses it, they’re in. Two-factor authentication (2FA) – also called two-step verification or multi-factor authentication (MFA) – adds a second check, so a stolen password alone isn’t enough. It is one of the most effective security steps you can take, and it takes about five minutes per account.

How 2FA works

Authentication factors fall into three groups:

• Something you know – a password or PIN.
• Something you have – your phone, a security key or a code generator.
• Something you are – a fingerprint or face scan.

2FA combines two different groups. When you sign in on a new device, you enter your password and confirm with something you have, such as a code from your phone.

Types of second factor, from good to best

Any second factor is far better than none. If you’re choosing, prefer an authenticator app over SMS, and passkeys or security keys where supported.

Never approve a sign-in prompt you didn’t start, and never read a code to anyone who calls or messages you. Legitimate support staff will not ask for your 2FA code.

Which accounts to protect first

1. Email – the account used to reset all your other passwords.
2. Password manager – see our password manager guide.
3. Microsoft, Google and Apple accounts – often linked to email, files, photos and device backups.
4. Banking and payment apps – many already require it.
5. Social media and messaging – frequently targeted for scams.
6. Shopping sites with saved cards and work accounts.

How to turn on 2FA (general steps)

Most services follow the same pattern:

1. Sign in and open Security or Account settings.
2. Find Two-step verification, Two-factor authentication or Multi-factor authentication.
3. Choose a method. For an authenticator app, the site displays a QR code; scan it with the app, then enter the code the app shows to confirm.
4. Save your backup or recovery codes when offered – print them or store them in your password manager.
5. Add a second method if possible, such as a backup phone number or a second security key.

For your Microsoft account, go to account.microsoft.com, choose Security, then Manage how I sign in. For Google, go to myaccount.google.com, select Security, then 2-Step Verification. Menu names change occasionally – the official help pages linked below have current instructions.

Choosing an authenticator app

Well-known options include Microsoft Authenticator, Google Authenticator and the authenticators built into many password managers. Look for:

• Encrypted backup or sync, so you don’t lose your codes if you lose your phone;
• an app lock (PIN or biometrics);
• download from the official app store only.

Passkeys: the next step

Passkeys replace passwords with a key stored on your device or password manager, unlocked by your fingerprint, face or PIN. Because the passkey only works on the genuine website, fake login pages can’t capture it. Major services including Microsoft, Google and Apple support passkeys. When a service offers them, setting one up gives you strong protection with less effort.

Avoid getting locked out

• Store recovery codes somewhere safe and separate from your phone.
• Register more than one method or device.
• Before changing phones, transfer your authenticator accounts or check that cloud backup is on.
• Keep your recovery email and phone number up to date.

Conclusion

Two-factor authentication stops the vast majority of account takeovers that rely on stolen passwords. Start with your email and password manager today, prefer an authenticator app, passkey or security key over SMS where you can, and save your recovery codes. Combined with being able to recognise phishing, it makes your accounts far harder to compromise.