How to set up two-factor authentication and keep a way back in

To set up two-factor authentication (2FA), open the account's security settings, turn on two-factor or 2-Step Verification and register a second sign-in method. Use a security key, a passkey or an authenticator app where you can, rather than text messages alone. Before you finish, set up a backup: a second method, saved backup codes or a recovery key. Without one, a lost phone can lock you out of the account.

What two-factor authentication does

With 2FA, a password alone no longer opens the account. You also need a second proof, usually something you have (a phone, an app or a hardware key) or something you are (a fingerprint or a face scan). The US Cybersecurity and Infrastructure Security Agency (CISA) lists four common forms on its MFA page: text or voice message, application-based MFA, phishing-resistant MFA, and fingerprint or face scan. It says "users who enable MFA are significantly less likely to get hacked." CISA marks that page as archived content, and it gives no figure for how much the risk falls.

Choose the method before you flip the switch

Second steps differ in strength. The clearest guide is NIST Special Publication 800-63B, part of Revision 4 of the US Digital Identity Guidelines, released as final on July 31, 2025.

Text-message codes: better than nothing, weakest option

NIST classes codes sent over the phone network (SMS or voice) as a "restricted" authenticator. Services that offer them "SHALL ensure that alternative authenticator types are available to all subscribers." Before sending a code, NIST says verifiers should check risk signals such as "device swap, SIM change, number porting." Those are the signs of an attacker moving your number to their own SIM. CISA's position is that "any MFA is better than no MFA." So keep SMS if it is the only option, and add a stronger method when the service offers one.

Authenticator-app codes

Authenticator apps usually produce time-based one-time passwords (TOTP). The algorithm is defined in RFC 6238, published by the IETF in May 2011 as an informational document. It defines TOTP as HOTP(K, T), where T counts the time steps since a start time T0. The RFC recommends "a default time-step size of 30 seconds," which is why codes change every half minute. It also recommends that servers accept at most one extra time step to allow for network delay. App codes do not depend on your phone number. NIST still notes that "OTP authentication is not phishing-resistant": a fake login page can ask you to type the code and pass it on to the real site.

Security keys and passkeys: phishing-resistant

NIST says phishing resistance "requires single- or multi-factor cryptographic authentication." At its AAL2 level, services "SHALL offer at least one phishing-resistant authentication option." Methods where you type a code by hand "SHALL NOT be considered phishing-resistant," because the typed code is not tied to the specific login session. CISA says "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication," which covers hardware security keys and passkeys.

Turn it on: Apple Account

Apple's support page (published Aug. 13, 2026) says two-factor authentication is "the default security method for most accounts." Apple Pay and Sign in with Apple require it. If yours is not on yet:

• iPhone or iPad: Settings > your name > Sign-In & Security, then turn on two-factor authentication and follow the prompts.
• Mac: System Settings > your name > Sign-In & Security, then the same steps.
• Web: sign in at account.apple.com. You may be asked for a code sent to your email or to answer security questions. Then choose Upgrade Account Security.

After setup, signing in on a new device or on the web needs your password and a six-digit code. The code appears on a trusted device or is sent to a trusted phone number.

You may not be able to switch it off later. Apple says: "If your Apple Account was created using two-factor authentication, this extra protection can't be removed." If you turned it on recently, you can lower your account security within two weeks of enrollment.

Turn it on: other accounts

Most services put the setting under Security, Sign-in or Account settings, labelled two-factor authentication, two-step verification or multi-factor authentication. The labels and menus differ between services. Take the steps from the service's own help pages, not from a third-party list.

Plan for the lost phone

Most lockouts happen here, so set this up on the day you turn on 2FA.

Backup codes

Google's 2-Step Verification help page says you can get "a new set of 10 backup codes." Each code is eight digits and can be used only once. To create them, go to your Google Account, then Security & sign-in, then 2-Step Verification, then Backup codes. When you make a new set, "your old set automatically becomes inactive." Other services use different counts and formats. The rules for well-built systems are in NIST SP 800-63B: a saved recovery code must contain at least 64 bits from an approved random generator, it must be stored on the service side only in hashed form, and it must be invalidated once used. NIST expects you to keep saved codes offline.

A second method

Register more than one sign-in method, such as a second security key, an authenticator app and a phone number. Losing one device then does not end your access.

Apple's recovery key, and what it costs you

Apple's recovery key page (published Sept. 14, 2026) describes a 28-character code that you use together with a trusted phone number and an Apple device to get back into your account. Setting one up turns off Apple's standard account recovery process. Apple warns that if you cannot provide the key after losing access, "you'll be locked out of your account permanently." To set one up on an iPhone: Settings > your name > Sign-In & Security > Recovery Key. Write the key down, store it safely and confirm it.

Recovery contacts

NIST says services "SHALL allow the subscriber to specify one or more addresses of trusted associates to receive issued recovery codes." If an account offers recovery contacts, add someone you trust.

A short checklist

1. Turn on 2FA in the account's security settings.
2. Add a security key, a passkey or an authenticator app. Keep SMS only as a fallback.
3. Register a second method.
4. Save backup codes or a recovery key offline, in more than one safe place.
5. Test a sign-in on a second device before you need it.

Limitations: menu paths are as Apple's and Google's pages stated them on the dates shown, and they can change. Other services' steps and recovery rules vary, so check each one's own help pages.

For crypto holders, account 2FA is one layer of protection. A separate explainer covers how to back up a crypto wallet and where to keep the backup.