Two-Factor Authentication: Set It Up and Save Recovery Codes

Photo by FlyD on Unsplash.

Two-factor authentication adds another check when you sign in, so a stolen password alone is less useful to an attacker. The setup is only half the job: you also need a way back into the account if your phone breaks, your number changes or you lose a security key.

Start with the accounts that unlock other accounts

Protect your main email and password manager first, then work through accounts containing financial information, private files or sensitive conversations. Look in each account’s security settings for labels such as two-factor authentication, two-step verification or multifactor authentication.

Open those settings directly from the service’s app or a known website address. Avoid starting from an unexpected message that tells you to secure your account urgently. Make a short list of accounts you have completed so that the work remains manageable.

Choose a supported method you can maintain

Services offer different combinations of security keys, passkeys, authenticator apps, approval prompts and text messages. CISA recommends phishing-resistant authentication where available. Passkeys and compatible security keys can provide stronger protection against fake sign-in pages than codes that someone can persuade you to reveal.

An authenticator app or another supported second step can still improve protection over a password alone. Check the service’s instructions rather than assuming that every account handles methods in the same way. For example, Google supports signing in with a password and a second step, or with a passkey.

Complete setup and check the result

1. Open the account’s security settings.
2. Select the authentication option and follow the enrollment instructions.
3. Complete the confirmation step, such as entering an initial code or using a key.
4. Check that the account now shows the feature as enabled.
5. Add a supported backup method before you finish.

For a personal Google Account on a computer, open Security & sign-in, find How you sign in to Google, and select the two-step verification option. Work or school accounts may have administrator-controlled requirements. The exact names and available methods can change, so use the official help linked below if your screen differs.

Store recovery codes somewhere you can reach

When a service offers recovery codes, treat them as account keys. Store them in a secure place that remains accessible if your usual sign-in device is unavailable. A printed copy with important documents is one option; an appropriately protected digital record is another.

Google’s backup codes are single-use. Creating a new set invalidates its previous set. Other providers may work differently, so label your record with the account and creation date, and follow that provider’s replacement process if the codes are exposed or lost. Do not send them to someone claiming to be support.

Plan for a new phone before wiping the old one

Before replacing a device, review the transfer instructions for your authenticator or passkey provider. Confirm that your replacement method works and that recovery details are current. Keep the old device available until you have verified access to your important accounts, then remove obsolete methods through their security settings.

Approve a sign-in prompt only when you have just initiated that sign-in. If an unexpected prompt appears, deny it and review the account directly. Extra authentication is a useful barrier, but it still depends on careful decisions about codes, prompts and recovery access.

Sources and further reading

• CISA: Require multifactor authentication
• Google Account Help: Turn on 2-Step Verification
• Google Account Help: Sign in with backup codes

For the account-security basics, see our strong passwords and password manager guide.