How to set up two-factor authentication

A password alone can be guessed, leaked or phished. Two-factor authentication adds a second step, usually a short code from your phone, so a stolen password is not enough to get in. Setting it up takes a few minutes per account. The part people skip, and later regret, is saving backup codes in case the phone is lost.

A practical setup order, then authenticator apps, with a section for authenticator apps rising by visits on the Censuus ranking. Never share a code with anyone who contacts you, even if they claim to be from the service.

Authenticator apps rising by visits and sponsorship on Censuus

A younger iPhone app from an independent developer:

Ranked by visit traffic and sponsorship on Censuus, not editorial opinion. The list changes as new apps appear and gain traffic.

Begin with the accounts that matter most

Your main email comes first, because it can reset passwords for almost everything else. Then banking and payment apps, then social and cloud accounts. Look for “two-factor”, “2-step verification” or “login security” in each account’s security settings.

Choose an authenticator app over SMS

Codes by text message are better than nothing, but they can be intercepted or redirected if someone takes over your phone number. An authenticator app generates codes on your device. Some services also support passkeys or hardware keys, which are stronger still.

Save your backup codes

When you turn on two-factor, most services offer backup codes. Save them offline, printed or in a secure place, not only on the phone that generates codes. Check that your authenticator app can back up or move codes to a new phone.

Never share a code

No real service will call or message you asking for your code. If someone does, it is a scam to take over your account. Compare apps in authenticator apps.

Compared from each developer’s own store description.
Step	What you do	Why
1. Start with email	your main email account first	it can reset everything else
2. Then money	banking, payments, shopping	direct financial risk
3. Prefer an app	authenticator app over SMS where offered	harder to intercept
4. Save backup codes	printed or in a safe place offline	access if the phone is lost
5. Never share codes	not by phone, chat or email	the most common trick

Frequently asked questions

How do I set up two-factor authentication?

Open the security settings of an account, turn on two-factor or 2-step verification, scan the code with an authenticator app and save the backup codes somewhere safe.

Is an authenticator app safer than SMS codes?

Generally yes, because codes are generated on your device rather than sent over the phone network, where they can be intercepted or redirected.

What if I lose my phone?

Use your saved backup codes to sign in, then set up two-factor again on the new phone. Apps with backup make moving codes easier.