How to Set Up Two-Factor Authentication on Every Major App

Your password is not enough anymore. Passwords leak in breaches, get guessed, and get handed over on fake login pages. Once someone has yours, they can walk into your email, your photos, and your money. Two-factor authentication, or 2FA, adds a second check after your password — a code from your phone — and a thief with your password still gets stuck at the door.

This guide covers the nine accounts that matter most: Google, Apple ID, Microsoft, Facebook, Instagram, WhatsApp, X, GitHub, and Amazon. Ten minutes each, starting with your email — and save your backup codes first.

What you need before you start

Four things. An authenticator app — Google Authenticator, Microsoft Authenticator, or Authy, all free. A phone number you control, for accounts that still use text codes. A safe place for backup codes: a password manager or paper in a drawer, never a screenshot in your camera roll. And a recovery email you can still open.

Google

Protect this one first. It holds your Gmail, Drive, and photos, and it can reset the password on half your other accounts.

1. Go to myaccount.google.com, sign in, and open Security.
2. Under How you sign in to Google, select Turn on 2-Step Verification.
3. Choose the authenticator app, scan the QR code, and enter the code. Then save the 10 Backup codes from the same page — each works once.

Google also offers a "Yes, it's me" phone prompt and passkeys. A new number can take up to seven days to be trusted — add it now.

Apple ID

New Apple IDs have 2FA on by default, and iCloud, Apple Pay, and Sign in with Apple require it. Older accounts should check.

1. On iPhone or iPad, open Settings, tap your name, then Sign-In & Security and Two-Factor Authentication.
2. If it is off, tap Turn On Two-Factor Authentication and confirm a trusted phone number.
3. On a Mac, find it in System Settings under your name. On the web, sign in at account.apple.com.

Codes arrive on your trusted devices, or by text or call to your trusted phone number. Apple does not use standard codes from third-party authenticator apps for Apple ID sign-in. Turned it on yourself? You have about two weeks to change your mind — then it is permanent.

Microsoft

One Microsoft account covers Outlook, OneDrive, Xbox, and Windows sign-in. Setup happens in a browser.

1. Sign in at account.microsoft.com/security and select Manage how I sign in.
2. Under Additional security, find Two-step verification and choose Turn on.
3. Pick the authenticator app, scan the QR code, and enter the code. Generate a recovery code from the same page and save it.

Microsoft recommends three pieces of security information — app, backup email, phone number — before you switch it on, and losing access can take up to 30 days to fix. Microsoft is also phasing out SMS codes for personal accounts, so set up the app now.

Facebook

Facebook shares its security settings with Instagram through Meta's Accounts Center — and a stolen account gets used to scam your friends within minutes.

1. Go to Settings, then Accounts Center, then Password and security, then Two-factor authentication.
2. Pick your Facebook account, choose Authentication app, and follow the prompts. Save the backup codes at the end.

Instagram

Instagram offers three ways to get a code: an authentication app, a text message, or WhatsApp. The app method can only be turned on from the Instagram app, not the website.

1. In the app, open your profile menu, then Settings and privacy, then Accounts Center.
2. Tap Password and security, then Two-factor authentication.
3. Choose your account, then Authentication app, and scan the QR code or copy the setup key.
4. Save your backup codes under Additional methods, then Backup codes — a new set cancels the old one.

WhatsApp codes need text-message 2FA on first.

WhatsApp

WhatsApp works differently: there is no login code. Two-step verification adds a six-digit PIN that WhatsApp asks for whenever your number is registered on a new phone.

1. Open WhatsApp, go to Settings, then Account, and tap Two-step verification, then Turn on.
2. Create a six-digit PIN — not your birthday, not 123456.
3. Add a recovery email. Do not skip this.

A forgotten PIN with no recovery email means a multi-day lockout. Never share your six-digit SMS registration code with anyone.

X

X offers 2FA through an authentication app, text messages, and security keys. The app method is the reliable choice — it works without signal.

1. In your security settings, open Two-factor authentication and choose Authentication app.
2. Scan the QR code, enter the code, and save the backup code X gives you — somewhere other than your phone.

GitHub

Your GitHub account guards your repositories and often the keys to production.

1. In your account settings, open the security section, then Two-factor authentication, and choose the authenticator app.
2. Scan the QR code, enter the code, and save the recovery codes GitHub shows you — your only way back in without the app.

Amazon

Your Amazon account holds payment methods, your address, and one-click ordering. Amazon calls the feature Two-Step Verification.

1. In your account settings, open the login and security section, then Two-Step Verification, and follow the prompts.
2. Save the backup option Amazon offers during setup.

Authenticator app vs SMS: which second factor should you pick?

Authenticator app: a fresh six-digit code every 30 seconds, works offline, needs nothing from your mobile network. A SIM swap does nothing to it, because the code lives on your device. The catch: lose the phone without backup codes and you are locked out.

SMS: arrives on any phone with signal, no app needed. The price: texts travel unencrypted, can be intercepted, and a SIM swap hands your codes to the attacker. A VPN like NordVPN encrypts your connection on public Wi-Fi — it does nothing about SMS.

Order of preference: a hardware key for your most valuable accounts, an authenticator app everywhere else, SMS only where nothing better exists. If a service offers only SMS, turn it on anyway.

Backup codes and losing your phone

Backup codes are the spare key to every account here. Each works once, and any one gets you in when your phone is lost, stolen, or wiped. Keep a copy somewhere safe — never the only copy inside the thing they unlock.

Print them, or store them in your password manager — the same NordPass vault that holds your passwords works, as long as the vault is protected. Never a screenshot in your photo gallery.

Phone gone? Use a backup code to sign in, move the authenticator to the new phone, then generate fresh codes.

Common mistakes that undo good 2FA

• Protecting one account and ignoring the rest. Your email resets everything else.
• Using SMS everywhere. Better than nothing, but a SIM swap defeats it.
• Never saving backup codes. Setup takes two minutes; recovery without them takes days.
• Storing codes only on the phone they protect. A lost phone should not mean a lost account.
• Letting the recovery email go stale. An inbox you cannot open is no recovery at all.
• Turning 2FA off because it is annoying. Ten extra seconds at login is the cheapest security you will buy.
• Sharing codes with "support". No real support team asks for your 2FA code.

The same habits scale to a team — our beginner's cybersecurity roadmap for small business owners covers password policy, backups, and more.

Frequently asked questions

Does 2FA make my account unhackable? No. It blocks stolen passwords, phishing, and credential stuffing — but a targeted attacker can still phish a code in real time.

What if I lose my phone? Sign in with a backup code, move the authenticator to your new phone, and generate fresh codes.

Is SMS 2FA better than nothing? Yes. It stops bulk password attacks and anyone who only has your password — treat it as the floor, not the ceiling.

Can one authenticator app cover everything? Yes — Google Authenticator, Microsoft Authenticator, and Authy each hold codes for all your accounts.

Do I need 2FA on every account? Start with email, banking, your password manager, and cloud storage, then add social media and shopping. Accounts that reset others, or spend your money, come first.

Set aside an hour, start with Google, and work down the list. Pair 2FA with a password manager so every account gets its own long, unique password — one breach should never open every account you own.