What is two-step verification?
The short answer
Two-step verification (also called two-factor authentication or 2FA) requires you to prove your identity in two different ways when logging in, so a stolen password alone isn’t enough to access your account.
How it works
When you log in to an account with two-step verification enabled, you go through two stages:
- Step 1: Enter your password as usual.
- Step 2: Confirm your identity with a second method, like a code sent to your phone.
The idea is simple. Even if someone steals your password, they still can’t get in without that second piece of proof.
Common types of second steps
- Text message code — a one-time code sent via SMS to your phone number
- Authentication app — apps like Google Authenticator or Authy generate codes that refresh every 30 seconds
- Email code — a one-time code sent to a separate email address
- Push notification — a prompt on your phone asking you to approve or deny the login
- Physical security key — a small USB or NFC device you tap to verify
Authentication apps and security keys are considered the most secure options. Text messages work but can be intercepted in rare cases.
Should you turn it on?
Yes, for any account you care about. At a minimum, enable it on:
- Email accounts — these are the keys to resetting every other password
- Banking and financial apps
- Social media accounts
- Cloud storage like Google Drive or iCloud
How to set it up
Most services have the option under Settings > Security or Settings > Privacy. Look for terms like “two-step verification,” “two-factor authentication,” or “2FA.” The setup usually takes under two minutes.
A few tips
- Save your backup codes somewhere safe in case you lose access to your phone.
- Use an authentication app over SMS when given the choice.
- Don’t share verification codes with anyone, even if they claim to be from the company.