How to Set Up Two-Factor Authentication on Every Account That Matters
CodexFuse Team · 2026-10-28T00:34:48.929Z · 12 min read
Learning how to set up two-factor authentication is the single most useful security job you can do in one sitting. It takes about ten minutes per account, and once it is on, a stolen password alone is no longer enough to get into your account. This guide gives you the whole system: which second factor to pick, the exact steps for Google and every other account, the order to enable accounts in, and the backup plan that keeps you from locking yourself out.
Two-factor authentication, or 2FA, means signing in takes two things instead of one: something you know (your password) and something you have (your phone, or a code it generates). If you want the background first, read what two-factor authentication is before you start. And before you turn anything on, make sure your password itself is strong — a password generator can make a long random one in seconds, because 2FA protects a good password; it does not fix a weak one.
How Do I Set Up Two-Factor Authentication?
Set up two-factor authentication by installing an authenticator app, opening the security settings of the account you want to protect, turning on two-factor authentication, scanning the QR code the site shows you, and entering the six-digit code your app generates to confirm. Then save the backup codes the site gives you somewhere safe, somewhere other than your phone.
- Install an authenticator app. Google Authenticator, Microsoft Authenticator, Authy, 1Password, or Bitwarden all work — any app that supports time-based one-time passwords (TOTP) will do.
- Open the account's security settings. Look for Security, Password & Security, or Sign-in & Security in the account menu.
- Turn on two-factor authentication. The button is usually labelled "Two-factor authentication", "2-Step Verification", or "Enable 2FA". You may be asked to enter your password again first.
- Scan the QR code. Open your authenticator app, tap the plus or "Add account" button, and point your camera at the QR code on screen. If you cannot scan it, type in the text key shown underneath instead.
- Enter the six-digit code. Your authenticator app now generates a new six-digit code every 30 seconds. Type the current code into the site and confirm.
- Save your backup codes. The site will show you a set of one-time backup codes. Download or print them and store them somewhere safe — not on the same phone.
That is the whole setup. It is the same on almost every service, because the underlying system is the same: the QR code hands your authenticator app a secret, and the app turns that secret into a fresh code every 30 seconds. The NOC support guide describes exactly this flow — scan the QR code, enter the six-digit code, and 2FA is active — and the same steps appear in the Make help centre, which adds that you should download the one-time passwords as a text file and save them somewhere safe, not on your mobile device.
Which Second Factor Should You Pick? Authenticator App vs SMS vs Passkey
Pick an authenticator app. It is the best balance of security and convenience for almost everyone: it works without mobile signal, it cannot be intercepted the way a text message can, and it is free.
| Second factor | How it works | Security | Works offline? | Best for |
|---|---|---|---|---|
| Authenticator app | Generates a six-digit code every 30 seconds | Strong — codes never travel over the network | Yes | Almost everyone |
| Text message (SMS) | A six-digit code is texted to your phone | Weakest — vulnerable to phone-number hacks | No — needs signal | Only when nothing else is offered |
| Passkey / security key | Your fingerprint, face, or a small hardware key | Strongest — resists phishing | Yes | Your most important accounts |
| Push prompt | Tap Yes on a notification on your phone | Strong — tied to your device | No — needs internet | Google and Microsoft accounts |
The SMS warning comes straight from Google's own support page: "Although any form of 2-Step Verification adds account security, verification codes sent by texts or calls can be vulnerable to phone number-based hacks." A SIM swap is the classic version of that attack — someone convinces your carrier to move your number to their SIM, and your texted codes start arriving on their phone. Google prompts, by contrast, "can also help protect against SIM swap and other phone number-based hacks", because the prompt is tied to a signed-in device, not to a phone number.
That does not mean SMS 2FA is useless. Any second factor beats none. But if a service offers an authenticator app or a passkey, take that option first and leave SMS as the backup, not the main method. If you want the strongest option, set up passkeys on the accounts that support them — Google says passkeys and hardware security keys protect your account from phishing attacks, because a passkey cannot be written down or accidentally handed to a scammer.
How to Set Up 2FA on Google
To set up 2FA on Google, open your Google Account, tap Security & sign-in, and under "How you sign in to Google" select Turn on two-step verification, then follow the on-screen steps. Google calls it 2-Step Verification, but it is the same thing as two-factor authentication.
- Open your Google Account at myaccount.google.com and sign in.
- Tap Security & sign-in in the left menu.
- Under "How you sign in to Google", select Turn on two-step verification.
- Follow the on-screen steps to verify it is you — usually by entering your password and confirming on a device you already use.
- Choose your second step. Google recommends Google prompts (tap Yes on your phone) if you do not use a passkey. You can also add Google Authenticator or another code app, or a text-message code.
- Save your backup codes. Google lets you print or download a set of eight-digit backup codes to keep in a safe place, for the day you lose your phone.
Two Google details are worth knowing before you start. First, if you add a phone number for 2-Step Verification, Google says it may take up to 7 days for Google to trust the phone number, so do not set it up the night before a trip. Second, if you use an account through your work, school, or another group, these steps might not work — contact your administrator instead, because your organisation may manage 2-Step Verification for you.
Which Authenticator App Should You Install?
Any TOTP-compatible authenticator app works, and they all do the same job: hold the secret from the QR code and generate a new six-digit code every 30 seconds. The NOC support guide lists Google Authenticator, Authy, 1Password, Microsoft Authenticator, and Bitwarden, and any of them will set up 2FA on any service that offers an authenticator option.
Pick the one that fits your life. If you already use a password manager, use its built-in authenticator — one app to open, and your codes back up with your vault. If you want a standalone app, Google Authenticator and Microsoft Authenticator are free and simple. Avoid picking a different app for every service; one app holding every account is easier to back up and much harder to lose track of.
How to Enable 2FA on Any Other Account
To enable 2FA on any other account, find the security settings, turn on two-factor authentication, scan the QR code with your authenticator app, and enter the six-digit code to confirm. The labels change from site to site, but the steps do not.
On most services the path is: profile icon, then Settings or Account Settings, then the Security tab, then Two-Factor Authentication, then Enable 2FA. You will be asked to confirm with your password, then shown a QR code with a text key underneath. Scan the code with your authenticator app, or type the key in manually if your camera cannot read it. Enter the current six-digit code, click Verify, and 2FA is on. The site will then show you its backup codes — save them before you click away, because some sites only show them once.
If you switch authenticator apps later, do it properly: disable 2FA on each account with your current app first, then enable it again with the new app. The Make help centre warns that switching requires disabling with the current authenticator app or a one-time password first — you cannot just install a new app and expect the old codes to follow.
What Order Should You Enable 2FA In?
Enable 2FA on your email first, because email is the reset hub for everything else. If someone gets into your email, they can reset the password of every account that sends its reset link there. After email, do your bank, then your social accounts, then everything else.
| Priority | Account | Why this order |
|---|---|---|
| 1 | Email (Gmail, Outlook, iCloud) | It resets every other password |
| 2 | Bank and payment apps | Direct access to your money |
| 3 | Password manager | It holds every other login |
| 4 | Social media | Identity theft and scams in your name |
| 5 | Shopping and delivery | Saved cards and addresses |
| 6 | Everything else | Work through the list over a week |
Do not try to do every account in one night. Do email and bank today, then one or two a day until the list is done. The order matters more than the speed: an attacker who cannot reach your email cannot reset your bank password, and a bank account behind 2FA is protected even if its password leaks.
While you are in your email settings, it is also the right moment to use a password manager properly if you do not already. Store your backup codes in the manager's secure notes, or print them and keep them with your important papers — either way, they must live somewhere other than the phone that holds your authenticator app. If you do not use a password manager, a standalone secure notes tool holds them the same way — encrypted behind one master password.
What Are Two-Factor Authentication Backup Codes?
Backup codes are one-time codes a service gives you when you turn on 2FA, so you can still sign in if you lose your phone. Each code works once, and then it is spent.
Google gives you a set of eight-digit backup codes that you can print or download. NOC gives you ten one-time backup codes and warns that each can only be used once. The exact count varies by service, but the rules do not: download or print them, store them in a secure location — a password manager or a printed copy in a safe — and never give them to anyone. Google's support page is blunt about it: do not give out your backup codes to anyone, and never share your verification codes with anyone, because scammers may try to take over your account. Google will never call you to verify a code.
If you use most of your backup codes, generate a fresh set. NOC's guide explains that regenerating backup codes immediately invalidates the old set, so save the new ones before you throw the old ones away. And if you lose both your authenticator device and your backup codes, expect a hard road: NOC says you will need to contact support with identity verification to regain access, and some services will not let you back in at all.
What to Do If You Lose Your Phone With 2FA
If you lose your phone with 2FA on it, stay calm and work the plan in this order: sign in with a backup code, then move your codes to the new phone, then revoke the old device. The whole point of the backup codes you saved is this exact moment.
- Use a backup code to sign in. On the sign-in screen, choose the backup-code option and enter one of the codes you saved. Each code works once, so use a fresh one.
- Turn off 2FA on your important accounts, then turn it back on with the new phone. Scan the new QR codes with your authenticator app on the new device. This is slower than transferring codes, but it always works.
- Or transfer the codes directly. Many authenticator apps can export your accounts to a new phone, and some let you move them with a QR code. Our guide explains how to move your 2FA codes to a new phone without getting locked out.
- Revoke the old phone. Once you are back in, check the signed-in devices list and remove the lost phone, so it can no longer approve sign-ins.
- Generate fresh backup codes. The ones you just used are spent. Save a new set before you forget.
Two preparations make this painless. First, keep a second device with the same authenticator app — an old phone or a tablet — so a lost phone is an inconvenience, not a crisis. Second, save your backup codes on paper, not just in a file on the phone you might lose. A printed sheet in a drawer has saved more accounts than any recovery form ever has.
2FA Mistakes That Lock People Out
The most common 2FA mistake is saving your backup codes on the same phone that holds your authenticator app. When that phone is lost, stolen, or wiped, the codes go with it — exactly when you need them most. Print them, or store them in your password manager's secure notes, where they survive a lost phone.
The second mistake is turning 2FA on and then forgetting it exists. Test it once: sign out and sign back in with the code, so you know the flow works and you know where the backup codes are. The third mistake is sharing a code with anyone, for any reason — including someone claiming to be support. No legitimate support agent will ever ask for your verification code or a backup code. And the fourth is disabling 2FA because it feels annoying: if you must disable it, NOC's guide notes you need your password and a current code to do it, which is exactly the protection working as intended.
Sources
- Google Support — Turn on 2-Step Verification (fetched 2026-10-28): 2-Step Verification definition, SMS codes vulnerable to phone-number-based hacks, Google prompts protect against SIM swap, eight-digit backup codes, up to 7 days for Google to trust a new phone number, passkeys and hardware keys protect against phishing, never share verification codes.
- NOC.org Support — Configure Two-Factor Authentication (2FA) (fetched 2026-10-28): TOTP authenticator app list, six-digit code every 30 seconds, ten one-time backup codes, regenerating invalidates the old set, disabling requires password plus current code.
- Make Help Center — Two-factor authentication (fetched 2026-10-28): QR code or manual key setup, download codes as a text file, save them in a safe place not on your mobile device, switching apps requires disabling 2FA first.
Frequently Asked Questions
How do I set up two-factor authentication on my Google account?
Open your Google Account, tap Security & sign-in, and under "How you sign in to Google" select Turn on two-step verification, then follow the on-screen steps. Choose Google prompts or an authenticator app as your second step, and save the eight-digit backup codes Google gives you. If your account is managed by work or school, ask your administrator, because those steps may not work on managed accounts.
Is SMS two-factor authentication safe?
SMS 2FA is better than no 2FA, but it is the weakest option. Google's own support page says verification codes sent by texts or calls can be vulnerable to phone number-based hacks, and a SIM swap attack can redirect your texts to someone else's phone. Use an authenticator app or a passkey whenever the service offers one, and keep SMS only as a backup method.
What happens if I lose my phone and can't get my 2FA codes?
Use one of the backup codes you saved when you set up 2FA — each one signs you in once. Then turn 2FA off and back on with your new phone, or transfer your codes from a second device. If you saved no backup codes and have no second device, you will need to go through the service's account-recovery process with identity verification, and some services will not restore access at all.
What is the best authenticator app?
Any TOTP-compatible app works, and they all generate the same six-digit codes every 30 seconds. Google Authenticator and Microsoft Authenticator are free and simple; Authy, 1Password, and Bitwarden are also listed by NOC's support guide. Pick the one you already use — if you have a password manager with a built-in authenticator, use that, so your codes back up with your vault.
Do I need two-factor authentication if I already have a strong password?
Yes. A strong password protects you against guessing, but not against a password that leaks in a data breach or is stolen by a phishing page. Two-factor authentication means the stolen password alone is not enough to sign in — the attacker would also need your phone or your codes. It is the one setting that turns a leaked password from a break-in into a failed attempt.