SECURITY
Two-Factor Authentication: Beginner’s Setup Guide
Set up two-factor authentication correctly, save recovery codes and avoid common lockout mistakes.
Two-factor authentication adds a second proof after your password. If a password is leaked, an attacker still needs your phone, authenticator, passkey or security key. The strongest setup is the one you can use reliably and recover safely, so plan the backup before switching it on.
Choose the right factor
Use a passkey or hardware security key when the service supports it. An authenticator app is a strong and widely available option. SMS is easier but depends on the carrier and phone number. Avoid security questions based on public facts. For important accounts, register two independent factors rather than relying on one phone.
Set it up from the official account
Open Security settings in the official app or website, re-enter the password and follow the setup instructions. For an authenticator app, scan the QR code only on your own device and confirm with the generated code. For a security key, register a spare at the same time if possible.
Store recovery codes safely
Download or print the recovery codes and keep them away from the device used for sign-in. A password manager is appropriate if its own account is strongly protected. Do not leave recovery codes in an unprotected photo gallery, email draft or shared cloud folder. Mark a code as used when the service does not do so automatically.
Test before you rely on it
Sign out on a secondary device and complete one login while you still have the original session open. Confirm that the backup method works and that contact details are current. Review trusted devices and active sessions every few months, especially after replacing a phone or SIM.
Quick checklist
- Prefer passkey, key or authenticator
- Register a backup factor
- Save recovery codes securely
- Test a sign-in
- Review trusted devices regularly
Frequently asked questions
Will 2FA stop every account attack?
No, but it blocks many password-only attacks. Phishing-resistant passkeys and security keys provide stronger protection.
What if I lose my phone?
Use a registered backup factor or recovery code, then remove the lost device from the account.