How to Set Up Two-Factor Authentication on Everything

01 What Is 2FA and Why It Matters

Two-Factor Authentication (2FA) adds a second verification step — usually a time-based code from an app, a push notification, or a physical hardware key — beyond your password. Even if an attacker steals your password through a data breach, phishing, or credential stuffing, they still cannot access your account without that second factor.

Why passwords alone fail

Over 80% of hacking-related breaches involve stolen or weak passwords. Billions of credential sets are available on the dark web. If you reuse passwords across sites (most people do), a breach on one site puts all your accounts at risk. 2FA is the single most impactful thing you can do to protect your accounts.

02 Method Comparison: Ranked by Security

Not all 2FA methods are equal. Here's how they rank from most to least secure — always use the highest option a service offers.

Method	Security Level	Phishing-Resistant	Notes
Hardware Key (YubiKey)	Best	Yes	FIDO2/U2F. Cannot be phished. Physical device required.
Authenticator App (TOTP)	Great	No	Time-based codes. Recommended for most people. Use Authy, Aegis, or built-in password manager TOTP.
Push Notification	Good	No	Convenient but vulnerable to MFA fatigue attacks (spamming approve requests).
SMS / Phone Call	Weak	No	Vulnerable to SIM swapping. Use only when no better option exists. Never rely solely on SMS.

03 Priority Accounts to Secure First

Start with the five most critical account types. Compromising any of these can cascade into losing everything else.

01
Email Account Your email is the master key — it controls password resets for everything else.
02
Password Manager This holds the keys to all your other accounts. Protect it first, before using it to protect others.
03
Banking & Finance Direct financial access — your bank, mobile money apps, and investment accounts.
04
Social Media High-value for scammers who hijack accounts to defraud your contacts.
05
Cloud Storage Google Drive, iCloud, OneDrive — often contains sensitive documents and backups.

04 Step 1 — Set Up an Authenticator App

Before you start enabling 2FA on individual accounts, download and configure an authenticator app first. This is the tool you'll scan QR codes with.

Authy — Recommended for most users. Supports cloud backup and multi-device sync, so you won't lose your codes if you switch phones.

Google Authenticator or Microsoft Authenticator — Reliable and widely compatible. Microsoft Authenticator also supports push notifications for Microsoft accounts.

Aegis (Android only) — Open-source, local-only storage. Best for privacy-conscious users comfortable managing their own backups.

Built-in TOTP in your Password Manager — 1Password, Bitwarden, and others now include TOTP. Convenient, but storing your password and 2FA code in the same app slightly reduces security isolation.

In Authy: go to Settings → Accounts → Authenticator Backups → Enable. This lets you restore all your 2FA codes if you lose or replace your phone.

In Google Authenticator: tap your profile icon → Transfer accounts → Export accounts. Save the export securely.

Do this before adding any accounts, so all future additions are automatically backed up.

Critical: Never share TOTP codes

Legitimate services will never ask you to read your 6-digit code over the phone or in a chat. If anyone requests your code, it is a phishing or social engineering attack. Hang up and verify through official channels.

05 Step 2 — The General 2FA Process

Regardless of which platform you're setting up, the process follows the same pattern on almost every service:

Log in and go to Settings. Look for a section labelled Security, Privacy, Account, or Login & Security. The exact path varies — if you can't find it, search "[service name] enable 2FA" for the latest official instructions, as menus change frequently.

Look for any of these labels: Two-Factor Authentication, Two-Step Verification, Multi-Factor Authentication (MFA), or Login Verification. Click Enable, Turn On, or Get Started.

The service will display a QR code. Open your authenticator app, tap the + or Add Account button, select Scan QR Code, and point your camera at the screen.

A 6-digit code will appear immediately. You have 30 seconds to enter it before it rotates to the next code — this is normal TOTP behaviour.

After confirming 2FA, every service will offer backup codes (typically 8–10 one-time codes). These are your safety net if you ever lose access to your authenticator app.

Save them now. Store them in your password manager, or print them and keep them somewhere physically secure. Do not store them only on your phone — if you lose the phone, you lose the codes too.

06 Step 3 — Platform-Specific Guides

Here are the exact paths for the most commonly used services. Menus can change — if a path doesn't match, search the service's help centre for "two-factor authentication".

myaccount.google.com → Security → 2-Step Verification → Turn On

account.microsoft.com → Security → Enable two-step verification

iOS: Settings → [Your Name] → Sign-In & Security → Two-Factor Authentication → Turn On

Settings & Privacy → Security and account access → Security → Two-factor authentication

Settings & Privacy → Security and Login → Two-Factor Authentication

Profile → Settings → Security → Two-Factor Authentication

Account & Lists → Your Account → Login & Security → Two-Step Verification → Get Started

Settings & Privacy → Sign in & security → Two-step verification

(Bitwarden / 1Password / LastPass) → Security / Account Settings → Two-Factor / MFA → Enable authenticator app

Pro Tip

Menus change regularly. If you can't find the 2FA setting using the path above, search "[service name] enable 2FA" to go directly to the service's current official help article.

07 Step 4 — Hardware Security Keys (Advanced)

For maximum security — especially for high-value accounts like email, password managers, and work accounts — consider adding a FIDO2/U2F hardware security key (e.g. YubiKey, Google Titan Key).

Hardware keys are phishing-resistant by design: the key only works on the actual legitimate website, so even if you're tricked into entering your password on a fake site, the key will not authenticate. Authenticator apps can't offer this guarantee.

Supported services include Google, Microsoft, Apple, GitHub, Dropbox, and most enterprise platforms. Add it as a second or primary method under the same Security settings where you set up your authenticator app.

Recommendation

Always register two hardware keys — one as primary and one as a backup kept in a safe place. If you lose your only key and have no backup codes, account recovery can take days through official support channels.

08 Step 5 — Backup Codes & Recovery

Even the best 2FA setup fails if you lose access to your second factor. Plan your recovery before you need it.

Download or copy backup codes for every account immediately after enabling 2FA. Store them in your password manager or in a physically secure location.
Add a secondary recovery phone number or email where supported — this gives you another route in if your primary method is unavailable.
Enable cloud backup in your authenticator app (Authy does this automatically). This protects against losing your phone.
If you ever lose your phone, use backup codes immediately. Contact support early — recovery via official channels can take 24–72 hours.
Test your login on a second device after setting up 2FA to verify everything works before you need it urgently.
Periodically review connected devices and active sessions in each account's security settings.

09 Best Practices & Common Pitfalls

Start with your 5–10 most critical accounts and expand from there
Use a password manager with strong, unique passwords alongside 2FA
Add multiple recovery methods to every account
Prefer authenticator app or hardware key over SMS
Update your authenticator app and review active sessions periodically
Test logins on a second device after setup

Don't

Skip saving backup codes — this is the most common mistake
Rely solely on SMS-based 2FA where better options exist
Tick "remember this device" on shared or public computers
Store backup codes only on your phone (loses them if the phone is lost)
Share 6-digit codes with anyone — no legitimate service ever asks
Forget to update recovery info when you change your phone number