A strong, unique password is an important first step, but passwords can still be stolen through phishing, exposed in data breaches, or otherwise compromised.

Two-factor authentication (2FA), sometimes called multi-factor authentication (MFA), adds another layer of protection by requiring an additional form of verification before someone can access your account.

That means if someone gets your password, they still have another barrier to get through.

How Does 2FA Work?

You've probably used 2FA before. After entering your password, a service may ask you to:

Approve a notification through an authenticator app
Enter a code generated by an authenticator app
Enter a code sent through text message
Use a fingerprint or facial recognition
Use a security key
Use a passkey

The options available depend on the service you're using. Whenever an important account offers 2FA, turn it on.

Not All 2FA Is the Same

While any supported 2FA is generally better than relying on a password alone, some methods offer stronger protection than others.Text messages provide an additional layer of security, but authenticator apps don't rely on your phone number or cellular network. Passkeys and security keys can provide even stronger, phishing-resistant protection. CISA recommends phishing-resistant MFA where available.

Never Share Your Verification Codes

Treat a one-time verification code just like your password. Never give a verification code to someone who calls, texts, or emails you asking for it.

A common scam looks something like this: "Hi, this is support. We're trying to secure your account. I just sent you a six-digit verification code. Can you read it back to me?"

That code may actually be the final thing the person needs to access your account.

Plan Ahead for a Lost Phone or New Number

Because 2FA ties access to a device or phone number you own, losing your phone or changing your number without a backup plan can lock you out of your own accounts.

Save your backup codes: When you turn on 2FA, most services give you a set of one-time recovery codes. Save these somewhere safe outside of your phone (like a password manager or a printed copy in a secure spot).
Upgrade devices in parallel: If you get a new phone, do not wipe or trade in your old phone right away. Keep both devices side by side so you can use the old phone to approve logins while you transfer your authenticator apps and update your settings on the new one.
Update your number first: If you plan to change your phone number, switch your accounts over to an authenticator app or update your new number in your account settings before canceling your old service.

Turn On 2FA for Your Email

Your email account is especially important to protect because it is often used to reset passwords and recover access to other accounts. If you haven't already, take a few minutes to turn on 2FA.

The exact steps vary by provider, but you'll usually find 2FA under Account, Security, Sign-In, or Two-Step Verification settings.

Tip: When you're given a choice, use an authenticator app, passkey, or security key rather than a text message when possible. But if SMS is the only option available, SMS 2FA is still an additional layer compared with relying on a password alone.

Gmail / Google

Open your Google Account.
Select Security & sign-in.
Under How you sign in to Google, select 2-Step Verification.
Select Turn on 2-Step Verification and follow the prompts to choose your verification method.]