Two-factor authentication (2FA) is the single biggest security upgrade you can make in five minutes. It adds a second step to logging in — a rotating code from your phone — so a stolen or leaked password alone is no longer enough for an attacker to get in.
This guide walks through setting up 2FA properly, why an app beats SMS, and the one step (backup codes) people skip and regret.
What you need
- ✓The account you want to protect (start with email).
- ✓An authenticator app on your phone, or a browser-based TOTP tool.
- ✓Somewhere safe to store backup codes.
Step-by-step
- 1
Find the 2FA settings
In the account's security settings, look for 'Two-factor authentication', 'Two-step verification' or '2FA'. Start with your email — it can reset every other account, so it's the most important one to protect.
- 2
Choose an authenticator app, not SMS
Pick 'authenticator app' over text-message codes where possible. SMS can be intercepted or SIM-swapped; an app generates codes offline on your device, which is more secure and works without signal.
- 3
Scan the QR code (or enter the key)
The service shows a QR code. Scan it with your authenticator app, or copy the Base32 secret key into a TOTP tool. This links the app to the account so it can generate matching codes.
- 4
Confirm with a code
The app now shows a 6-digit code that changes every 30 seconds. Enter the current one to prove the setup worked. From now on, you'll enter a fresh code at each login.
- 5
Save your backup codes
The service gives you one-time backup codes — save them somewhere safe (a password manager or printed copy). If you ever lose your phone, these are how you get back in. This is the step people skip and regret.
Examples
- Setting up 2FA on email first, then reusing the same authenticator app for banking, social and work accounts — one app, many codes.
- A lost phone was no crisis because the backup codes let the user log in and re-enrol a new device.
Tips
- →Protect email with 2FA first — it's the reset key to everything else.
- →Prefer an authenticator app or passkey over SMS codes.
- →Save backup codes offline; without them a lost phone can lock you out.
- →Consider a second enrolled device or a hardware key for critical accounts.
- →You can add the same account to a backup TOTP tool so you're never fully dependent on one device.
Common mistakes
- Using SMS when an app is available. Choose an authenticator app; SMS is vulnerable to interception and SIM swaps.
- Skipping backup codes. Save them safely — they're your recovery if you lose your phone.
- Only protecting 'important' accounts. Start with email, then enable 2FA everywhere it's offered.
- Storing codes only on the lost-able device. Keep backup codes somewhere separate from the phone itself.
Conclusion
Setting up 2FA takes five minutes and blocks the vast majority of account takeovers: open security settings, choose an authenticator app over SMS, scan the code, confirm, and — crucially — save your backup codes. Do email first, then everything else.