What Is Two-Factor Authentication (2FA) and How Do I Turn It On?
What two-factor authentication is, how SMS codes, authenticator apps and passkeys compare, and how to enable 2FA on Gmail, Instagram, Facebook and WhatsApp.
· 3 min read
Two-factor authentication (2FA) asks for a second proof besides your password when you log in — usually a one-time code from your phone. Even if your password leaks, an attacker can't get past that second step.
According to Microsoft, 2FA blocks more than 99% of account takeover attacks. It's the most effective single thing you can do for your account security.
How it works
- You enter your email and password as usual — something you know.
- The site asks for a second proof — something you have: your phone, a security key, or your fingerprint.
- If both are correct, you're in.
An attacker who got your password from a phishing site or a data breach still doesn't have your phone, so they can't get in.
Types of 2FA: which should I choose?
| Method | How it works | Security |
|---|---|---|
| SMS code | A 6-digit code is texted to you | Medium — can be stolen with SIM swaps or "send me the code" scams |
| Authenticator app | The app generates a new code every 30 seconds | Good — the code only exists on your phone |
| Passkey / security key | Fingerprint, face unlock or a physical USB key | Best — doesn't work on phishing sites |
Recommendation: use a passkey or an authenticator app wherever possible. SMS is still far better than nothing.
Popular authenticator apps: Google Authenticator, Microsoft Authenticator, 2FAS, Aegis (Android), Bitwarden Authenticator.
How to turn it on in popular services
Menu names can vary slightly between app versions.
Gmail / Google account
myaccount.google.com → Security → 2-Step Verification. You can add a passkey, Google Authenticator or phone prompts there.
Instagram and Facebook
Accounts Center → Password and security → Two-factor authentication → choose the account → choose Authentication app. More: How to secure your Instagram account.
Settings → Account → Two-step verification → set a 6-digit PIN and add an email. More: How to protect your WhatsApp account.
Banking apps
Most banks already use SMS or in-app confirmation. Check the Security section of your bank's app and turn on fingerprint login.
Backup codes: don't skip them!
When you turn on 2FA, most services give you backup (recovery) codes. If your phone is lost or broken, they're the only way back into your account.
- Keep them in a password manager or on paper somewhere safe.
- Don't store them as a screenshot in your photo gallery.
- Remember to move your authenticator app to your new phone — some apps (e.g. Google Authenticator) can back up your accounts to the cloud.
FAQ
Will I have to type a code every time? No. Usually you're only asked on a new device or after a long time. On your own phone you can choose "trust this device".
Someone is asking me for my code — what now? It's 100% a scam. No service, bank or "friend" will ever need your 2FA code. Never share it.
I have a strong password — do I still need 2FA? Yes. A strong password protects against guessing, but not against a password typed into a phishing site or leaked in a breach. 2FA is your last line of defence.
Don't have a strong password yet? Create one here — and read strong password examples.