How to Set Up Two-Factor Authentication Without Locking Yourself Out

By Dana Okafor · Published Sep 22, 2026 · 8 min read

In this guide

Which accounts to protect first
The kinds of second factor, from good to best
Setting it up, step by step
Backup codes are the part everyone skips
When you change phones

Passwords leak. They get reused, guessed, phished, and exposed in data breaches at companies you have never thought about since you signed up. Two-factor authentication (2FA) means a stolen password alone is not enough: an attacker would also need your phone, an app, or a physical key.

The catch is that two-factor protects against you too, if you set it up carelessly. The goal of this guide is to turn it on for the accounts that matter while making sure a lost, broken, or upgraded phone never locks you out.

Which accounts to protect first

You do not need to do everything today. Start with the accounts that can be used to reset all the others, then work outward.

Your main email account — it can reset nearly every other password
Your Apple, Google, or Microsoft account, which controls your phone, photos, and backups
Banking, payment, and investment accounts
Your password manager, if you use one
Social media accounts, which scammers love to hijack to target your friends

The kinds of second factor, from good to best

Text-message codes are the most common and much better than nothing, but they can be intercepted by SIM-swap fraud, where a criminal persuades a carrier to move your number to their SIM.

Authenticator apps generate a six-digit code that changes every 30 seconds, entirely on your phone. They are not vulnerable to SIM swaps and work without signal. Many services also offer push prompts — "Is this you signing in?" — which are convenient, though you must never approve a prompt you did not trigger.

Passkeys and hardware security keys are the strongest option. They cannot be phished, because they only work on the real website. Passkeys are built into modern phones and computers and are becoming the default on major services.

Setting it up, step by step

Most services put two-factor under a Security or Sign-in section of account settings. The flow is usually the same: choose a method, scan a QR code with your authenticator app or confirm a code by text, and then save your backup codes.

Choose an authenticator app that backs up or syncs, so codes survive a new phone
Scan the QR code, then type the six-digit code to confirm
Save the backup codes immediately — in your password manager, or printed and kept at home
Add a second method as well, such as a backup phone number or a passkey
Test it: sign out and sign back in once to be sure it works

Backup codes are the part everyone skips

Every service that offers two-factor also offers a set of one-time backup codes. They are your spare key. If your phone is lost and your authenticator did not back up, a backup code gets you in immediately, instead of a recovery process that can take days.

Do not store backup codes only on the same phone as your authenticator. A password manager that you can reach from a computer, or a printed sheet in a drawer, both work.

When you change phones

Before wiping or trading in an old phone, open your authenticator app and confirm its codes are backed up or transferred to the new phone. Google Authenticator and Microsoft Authenticator both have transfer or backup options, and several password managers can store codes directly.

Only wipe the old phone after you have signed in to your most important accounts from the new one.

This is general technology information for home users, not professional IT or security advice. Menus and features change between software versions — check your device maker's official help pages for the current steps.

🔓

Keep reading

Watch a short ad to unlock the rest of this guide — free, no account needed.