What Is Two-Factor Authentication and How to Turn It On

Think of it like a second lock on your front door.

Your password is the first lock. Two-factor authentication — often written as "2FA" — is the second lock. Even if someone figures out your password, they still cannot get into your account because they do not have the second key.

The second key is usually a short code that gets sent to your phone by text message. You type in that code after your password, and the account opens. The code expires in a minute or two, so even if someone intercepts it, it is useless by then.

Why does this matter?

Data breaches happen regularly at large companies. When a company's database is stolen, millions of usernames and passwords end up for sale online. If you use the same password at multiple sites, criminals will try that password everywhere. Two-factor authentication stops them cold. They have the password but not your phone.

According to Google's own research, turning on 2FA blocks over 99% of automated hacking attempts. It is one of the single most effective things you can do for your online safety.

What happens when you log in with 2FA turned on

1. 1You go to the website and type your email and password as usual.
2. 2The site sends a text message to your phone with a six-digit code.
3. 3You type that code into the box on the screen.
4. 4You are in.

This takes about 30 extra seconds. Most sites let you check a box that says "Remember this device for 30 days" or similar, which means you only have to do the second step on a new device or after 30 days — not every single time.

What if I do not get the text?

A few common reasons: the text was delayed (wait 60 seconds), your phone's signal is weak, or you entered your phone number incorrectly when setting up. Every site with 2FA has a backup option — usually a link that says "Didn't get the code? Try another way" or "Get a backup code." Use that link if the text does not arrive.

How to turn on 2FA for Gmail (Google account)

Gmail is the most widely used email service in the United States. Here is how to add 2FA:

1. 1Go to myaccount.google.com and sign in.
2. 2Click Security in the left-hand menu.
3. 3Look for the section called "How you sign in to Google."
4. 4Click 2-Step Verification.
5. 5Click Get Started.
6. 6Follow the steps. Google will ask for your phone number and send a test code to make sure it works.
7. 7Enter the test code and click Verify.
8. 8Click Turn On to finish.

From now on, when you sign into Gmail on a new device, Google will send a code to your phone.

How to turn on 2FA for your Apple ID (iPhone and iPad)

Your Apple ID is the account connected to your iPhone, iPad, and any Apple purchases. Protecting it is important.

1. 1Open the Settings app on your iPhone or iPad (the gray gear icon).
2. 2Tap your name at the very top of the screen.
3. 3Tap Sign-In & Security.
4. 4Tap Turn On Two-Factor Authentication.
5. 5Tap Continue.
6. 6Enter a trusted phone number — this is where Apple will send codes. Use your cell phone number.
7. 7Apple will send a test code to that number. Enter it to confirm.

From now on, when you sign in to your Apple ID on a new device, a six-digit code will appear on your existing phone or be sent by text.

What is an authenticator app? (Advanced option — not required)

Some people use an app called an authenticator instead of text messages. Google Authenticator and Microsoft Authenticator are two popular ones. These apps generate a six-digit code on your phone every 30 seconds, without needing a text message. They are slightly more secure than SMS codes but require a few extra setup steps.

If you are comfortable with SMS codes, there is no urgent need to switch. SMS-based 2FA is still a major security upgrade over using just a password. Authenticator apps are worth exploring once you are comfortable with the basics.

What to do when you receive a verification code

• The code is for your use only. No one from any legitimate company will ever call you and ask for the code. If someone does, hang up — it is a scam.
• Type the code into the box on the website. Do not share it by phone, text, or email.
• If you did not request a login and a code arrives unexpectedly, do not type it in. It may mean someone is trying to break into your account. Change your password right away.