How to Set Up Two-Factor Authentication

Step 1: List the accounts that would hurt most

Email, banking, your password manager, and any store with saved card details come first. Note what you changed, because the same adjustment usually applies the next time you work on your accounts.

Step 2: Install an authenticator app

Choose one that supports encrypted cloud backup or a clean export path. Read the label or the guidance for your accounts once before acting, since small differences matter here.

Step 3: Check whether the account offers passkeys

A passkey is stronger than a code and resists phishing, so take it when available. Work in small passes and look at the result after each one, so a slip is easy to fix while it is still small.

Step 4: Open security settings from a bookmarked address

Type the address yourself to avoid a lookalike login page. Photograph or jot down the finished stage once, which gives you a reference for the next attempt.

Step 5: Find the two-step verification section

It is usually under Sign-in and security rather than Profile. When in doubt, pause and compare against the picture above before continuing.

Step 6: Choose authenticator app over text message

App codes are generated on your device and are not tied to your phone number. Let it settle for a moment before judging the result, since the first impression often changes.

Step 7: Scan the QR code with the app

Hold the phone steady and let the account appear in the app list. Check the edges and the parts you cannot see easily; those are where most beginners miss something.

Step 8: Enter the six digit code to confirm

This proves the app and the account are in sync before anything is locked down. Use a light touch first; pressure and extra material are much easier to add than to remove.

Step 9: Save the recovery codes immediately

Download or copy them before closing the setup window. If you are unsure, do less than you think you need and check again; you can always repeat the step.

Step 10: Write the codes on paper and store them offline

A screenshot on the same phone is useless if that phone is lost. A slightly imperfect result here is fine and can be corrected later; a rushed fix usually costs more time.

Step 11: Add a backup phone number if offered

A trusted family number gives you a second route back in. Put the tools back in the same place afterward, so the next session starts without a search.

Step 12: Sign out and test one full sign-in

Confirm the flow works before you rely on it. Keep the same order every time, since a fixed sequence is easier to repeat than a list of separate decisions.

Step 13: Review trusted devices and remove old ones

Old laptops and tablets may stay signed in without a new prompt. Give this stage a couple of minutes before moving on, because rushing here is the usual reason your accounts ends up uneven.

Step 14: Repeat for the next account on your list

Work down the priority order in short sessions rather than all at once. Repeat the same motion at a steady pace rather than varying it, which keeps the finish consistent.

Keep going: How to Free Up Storage on Your Phone uses the same illustrated format and is a good next read. More checklists live in the Technology category.

Step 15: Set up a second factor on a spare device

An old phone kept at home can hold the same accounts. Choose the gentlest option that still works, then increase only if the result is not holding.

Step 16: Consider a hardware security key

A physical key blocks phishing sites because it will not authenticate a fake domain. Stop and tidy up as soon as this part is done, so the next stage starts from a clear surface.

Step 17: Plan a phone replacement in advance

Know which apps and codes must be migrated before you hand over an old device. Keep everything you might need within reach before starting, so you are not searching mid-step.

Step 18: Learn what a phishing code request looks like

Any caller asking you to read a code aloud is trying to sign in as you. If conditions are different today, adjust one thing at a time and leave everything else unchanged.

Step 19: Check the domain before entering any code

A real login page will never arrive through a shortened link in a text. Use a timer or a quick count rather than guessing, especially on your first few attempts.

Step 20: Review recent login activity monthly

Most services show unfamiliar locations and devices in one screen. Finish with a quick check of the whole area rather than only the part you just handled.

Step 21: Revoke sessions you do not recognize

Signing out everywhere forces a fresh second factor on every device. Work in small passes and look at the result after each one, so a slip is easy to fix while it is still small.

Step 22: Update recovery email and phone each year

An outdated recovery route can lock you out permanently. Repeat the same motion at a steady pace rather than varying it, which keeps the finish consistent.

Keep going: How to Create a Strong Password You Can Remember uses the same illustrated format and is a good next read. More checklists live in the Technology category.