Two-Factor Authentication Explained — How to Set It Up on Every Account

Two-factor authentication (2FA) adds a second verification step when you log in — so even if someone has your password, they can't access your account without also having your phone. It takes about 5 minutes to set up per account and stops 99% of automated attacks.

Which Type of 2FA to Use

Not all 2FA is equally secure. From weakest to strongest:

Type	How it works	Security	Recommended?
SMS code	Text message with 6-digit code	Basic	Yes — much better than nothing
Authenticator app	App generates time-based code	Strong	✅ Recommended
Hardware key	Physical USB/NFC device	Strongest	For high-risk accounts
Passkey	Built into device biometrics	Very strong	✅ Use when available

SMS codes are vulnerable to SIM-swapping attacks. An authenticator app is more secure and works offline. Google Authenticator and Authy are both free and work on Android and iPhone.

Set Up on Google Account

Go to myaccount.google.com → Security → 2-Step Verification
Click Get started and enter your password
Choose Authenticator app (recommended) or phone number
If using Authenticator: install Google Authenticator or Authy on your phone, then scan the QR code shown on screen
Enter the 6-digit code shown in the app to verify
Click Turn On

From now on, after entering your Google password on a new device, you'll be asked for the 6-digit code from your app.

Set Up on Apple ID (iPhone, Mac)

On iPhone: Settings → [your name] → Password & Security → Two-Factor Authentication → Continue

Apple uses your trusted devices and phone number for 2FA — not a separate app. When you sign in on a new device, a 6-digit code appears on your other Apple devices.

Set Up on Facebook

Settings → Security and Login → Two-Factor Authentication → Edit

Choose Authentication App, scan the QR code with Google Authenticator or Authy, enter the verification code, and click Enable.

Set Up on Instagram

Profile → Menu (☰) → Settings → Account Centre → Password and Security → Two-Factor Authentication → select your account

Choose Authentication App and follow the setup steps. Instagram and Facebook share the same Account Centre, so enabling it for one often enables it for both.

Set Up on Microsoft / Outlook

account.microsoft.com → Security → Advanced Security Options → Two-Step Verification → Turn on

Microsoft supports the Microsoft Authenticator app (their own), Google Authenticator, or Authy.

Save Your Backup Codes

Critical: Every service gives you backup codes when you enable 2FA. Save these somewhere safe — a password manager or printed paper stored securely. If you lose your phone, backup codes are the only way to access your account. Losing both your phone and your backup codes typically means permanent account loss.

Which Authenticator App to Use

Google Authenticator — simple, works offline, no account needed. Weakness: codes only exist on one device
Authy — recommended for most people. Backs up codes to the cloud (encrypted), syncs across multiple devices, works if you lose your phone
1Password / Bitwarden — if you use a password manager, many support TOTP codes built-in, keeping everything in one place