How can I set up two-factor authentication?

Two-factor authentication (2FA, sometimes called two-step verification) adds a second check on top of your password, so a stolen password on its own is not enough to get in. It is the single most effective thing most people have not yet turned on.

The types, weakest to strongest

Text-message codes. Better than nothing, but a code sent by text can be intercepted - notably through a SIM swap.
Authenticator apps. A free app - Google Authenticator, Microsoft Authenticator, or the one built into many password managers - generates codes on your device, with no message to intercept. A big step up.
Hardware security keys. A small device you tap or plug in. The strongest option: it cannot be phished or SIM-swapped, and it is ideal for your most important accounts.

Increasingly you will also see passkeys offered - a newer, phishing-resistant way to sign in that replaces the password itself, using your device's face, fingerprint, or PIN. Where an account offers a passkey, it is one of the safest options available and worth turning on. It is the direction most of the industry is heading. See what is a passkey, and should I use one?

Where to turn it on first

Your email - it can reset almost everything else.
Your banking and anything tied to money.
Your main social and shopping accounts.

Look in the account's Security or Login settings for "two-factor" or "two-step verification".

A few habits

Prefer an app or a hardware key over text-message codes wherever you can.
Save the backup codes it offers somewhere safe and offline, in case you lose your phone.
Never read a code aloud to anyone who contacts you - a code sent to you is for you.

If you only do one thing

Turn on app-based two-factor authentication for your email today. Once that one account is locked down, everything else becomes far harder to steal.