Set up two‑factor authentication with an authenticator app (step‑by‑step)

Before you begin, decide which authenticator app and backup strategy you’ll use. A local-only app is slightly more private and secure, but an app with encrypted backups or multi-device support makes recovery far easier if you replace or lose your phone. Pick the approach that fits how often you change devices and how much risk you can tolerate, then follow the steps below.

Choose an authenticator app and a backup approach

• Local-only apps (examples: Aegis, FreeOTP): Store codes only on the device. Fewer remote attack vectors, but losing the device can lock you out unless you kept recovery codes elsewhere.
• Apps with transfer or encrypted cloud backup (examples: Authy, Microsoft Authenticator, Google Authenticator transfer): Easier to restore accounts to a new phone. Protect the backup account with a strong, unique password and its own 2FA where available.
• Hardware keys (YubiKey, Titan): Strong option for high-value accounts. They require service support and are a separate physical item to keep track of.

If unsure, choose an app that supports encrypted backups and plan to store recovery codes offline (for example, in a password manager and a printed copy in a secure place).

Set up two‑factor authentication with an authenticator app — the core steps

1. Prepare the account and phone: Make sure the account has a strong, unique password first. Install your chosen authenticator app on the phone you’ll use.
2. Find the account’s 2FA setup page: Sign in, open Security or Account settings, and choose “Two‑factor authentication,” “2‑Step Verification,” or “Authenticator app.” Pick the authenticator app option instead of SMS when available.
3. Link the app to the account: The site will present a QR code and often a manual secret key. In the authenticator app choose Add account → Scan QR code (or Manual entry), then scan the screen or paste the secret key. If the camera can’t read the code, use manual entry.
4. Verify the one‑time code: The app will display a 6‑digit code that typically refreshes every 30 seconds. Enter the current code on the site to confirm setup.
5. Save recovery codes now: Download, print, or store the recovery/backup codes in a secure password manager and keep a printed copy somewhere safe. These are typically the fastest way to regain access if you lose the authenticator.
6. Enable practical backups: If the service offers an additional backup phone, alternate email, or hardware key option, enable and record what you will actually use. Avoid relying on SMS alone for critical accounts.
7. Test sign-in while you still have access: Sign out and sign back in to confirm the authenticator and your saved recovery methods work. Do not reset or wipe the old phone until you’ve transferred or backed up accounts.

What to check right after setup

• Recovery codes saved: If you haven’t saved the recovery codes, stop and do that now in two places (for example, a password manager and a printed copy).
• Sign‑in verification: Confirm you can sign in using the authenticator code and a recovery code if needed.
• Clear labels: Rename accounts in the authenticator app where possible so each entry shows the service name and the account email—this prevents using the wrong code.
• Phone replacement plan: If you expect to switch phones soon, enable the app’s transfer or backup feature or add a second device before wiping the old one.

Troubleshooting common failures and fixes

• Codes are rejected: Time‑based codes require an accurate device clock. Enable automatic network time on Android or iPhone; some authenticator apps include a manual time sync option.
• QR code won’t scan: Allow the app camera permission, increase screen brightness, enlarge the browser window, or use the manual secret key.
• Lost phone: Use your saved recovery codes to sign in and reconfigure 2FA. If you used an app with encrypted cloud backup, restore to a new device using that app’s restore process. If you have no backup or codes, contact the service’s account recovery—expect identity verification and potential delays.
• Multiple similar entries: Rename entries in the authenticator so each one clearly matches the service and account.

Maintenance and safety tips

• Protect backups: Store recovery codes securely (password manager and a printed copy). If you use cloud backups for the authenticator, secure that backup account with a strong, unique password and its own 2FA.
• Use a strong password too: 2FA adds protection but doesn’t replace a strong, unique password for each account.
• Reserve cloud backups for convenience: For critical accounts (primary email, banking), consider a local-only authenticator combined with a hardware key for extra security.
• When replacing phones: Transfer authenticator accounts before wiping the old device. Use export/import or an official transfer feature while both devices are available—wiping first can cause permanent loss.
• Periodic review: Annually confirm recovery codes still work, remove old devices from apps and account security pages, and revoke any lost or unused hardware keys.