How to turn on two-step login
Two-step login means a thief needs something besides your password: a code from an authenticator app, a tap on a passkey, or a physical security key. Turn it on in each account's security settings, start with the email account that receives your password resets, and store the one-time recovery codes on paper with your important documents so a lost phone does not lock you out.
About 15 minutes to learnEveryday skill
Mark it once you can do it without this page open.
How to do it
- Open the security or sign-in section of your main email account's settings.
- Pick an authenticator app, a passkey or a security key over text message codes when you are offered a choice.
- Scan the setup code with the app or follow the passkey prompt, then type the first code to confirm.
- Print or write down the recovery codes and file them with your important papers.
- Repeat for your bank, phone carrier, cloud storage and any social account you care about.
- Sign out and back in once to make sure the second step works before you need it.
Common mistakes
- Turning it on everywhere except the email account that resets all the others.
- Saving recovery codes only on the same phone that holds the authenticator.
- Tapping approve on a login prompt you did not start.
Quick self-check
Three questions. Your last score is kept in this browser.
Teach this to someone
A one-page sheet for showing a friend, a roommate or a kid: what to say, what to show, and one question to check it landed.
Teach: How to turn on two-step login
What to say
Two-step login means a thief needs something besides your password: a code from an authenticator app, a tap on a passkey, or a physical security key. Turn it on in each account's security settings, start with the email account that receives your password resets, and store the one-time recovery codes on paper with your important documents so a lost phone does not lock you out.
What to show, in order
- Open the security or sign-in section of your main email account's settings.
- Pick an authenticator app, a passkey or a security key over text message codes when you are offered a choice.
- Scan the setup code with the app or follow the passkey prompt, then type the first code to confirm.
- Print or write down the recovery codes and file them with your important papers.
- Repeat for your bank, phone carrier, cloud storage and any social account you care about.
- Sign out and back in once to make sure the second step works before you need it.
The check question
Ask: Why start with your email account?
Related skills
- How to start using a password manager
- What to do if an account gets hacked
- How to spot a phishing email or text
- Every skill in Tech and Digital Safety
Words on this page
Sources
- National cybersecurity agency guidance for home users, 2026. Checked September 28, 2026.
Last reviewed . First published .