What is two-factor authentication and how do you turn it on?

• Information Security
• Updated: 4 October 2026
• About 4 min read

Steps to turn on two-factor authentication

1. 1

   Open your account's security settings

   In most services, two-factor authentication is found in the Security section of the account settings. Google account: Manage your Google Account > Security > 2-Step Verification. Microsoft account: two-step verification or the advanced security options in the Security section of your account page. On company accounts, your IT administrator may have made this setting mandatory.

   : Enlarge

2. 2

   Choose the verification method

   If you can, choose an authenticator app (such as Google Authenticator or Microsoft Authenticator) or a security key / passkey; these are more secure than SMS. With an authenticator app, scan the QR code on the screen with your phone; the app generates a 6-digit code that changes every 30 seconds. Enter this code on the account page to confirm the setup.

   : Enlarge

3. 3

   Store your recovery codes

   Print the backup / recovery codes you are given during setup, or store them in your password manager. If you lose your phone, you can use these codes to get into your account. If possible, add a second verification method as well (a backup phone number or a second key).

   : Enlarge

App passwords in email programs

After you turn on two-factor authentication, some older email programs or devices may be unable to sign in because they cannot ask for the second step. For this situation, some services offer a special app password created in the account settings. If possible, use a program that supports modern sign-in; use an app password only when necessary, and only in that program.

Things to watch out for

• Never give your verification code to anyone who asks for it by phone or email; genuine organisations do not ask for your code.
• Do not approve a sign-in notification that arrives when you are not expecting one; someone may be trying to sign in with your password, so change your password.
• Before changing phones, move the accounts in your authenticator app to the new phone.
• If you manage a website, turn on two-factor authentication for your hosting panel, domain account and admin panel too. For the website side, see the Login and session security guide.

Frequently asked questions

Related guides

• How to create a strong password. What is a password manager?Long passwords that are never reused, passphrases, and how to use a password manager.
• How to spot a phishing emailThe tell-tale signs of fake emails, how to check links and attachments, and what to do if you clicked.
• What is ransomware? The 3-2-1 backup ruleHow to protect yourself against ransomware, the 3-2-1 backup rule and what to do during an attack.
• Website security guide: where should you start?Threat types, layered defence, priorities and a roadmap to all the security guides.