How to Turn On Two Factor Authentication on a Phone (2026)

To turn on two factor authentication on a phone, open your account’s security settings on the device itself, switch on two-factor authentication or two-step verification, then confirm one code from the method you picked. On an iPhone the switch sits under your name in Settings, and on Android it lives inside the Google Account or Samsung Account security page.

The whole process takes about five minutes per account, and doing it properly means more than flipping a toggle. You need to save your recovery codes somewhere safe before you start, because turning 2FA on without a way back in is the single most common way people lock themselves out.

One thing worth clarifying before we start. Apple calls it two-factor authentication and turns it on automatically when you use an Apple Account on an iPhone. Google, Samsung and Microsoft call the same protection two-step verification. Same idea, different menu label, and a Galaxy phone can have three separate accounts with three separate settings.

What You Need

Four things, and you can check them off in a minute:

• A phone with the latest available iOS or Android security updates installed.
• The password for the account you are securing. You will be asked for it during setup.
• A verification method: an authenticator app, an SMS-capable phone number, or a passkey if the account supports one.
• A secure place for backup codes, such as a password manager or a printed sheet in a locked drawer.

The phone number matters more than people expect. If you plan to use text message codes, the number already attached to the account has to be one you still control. A number from a carrier you cancelled last year is the number that will fail you later.

Here is where the setting lives for each account type. Wording shifts slightly between iOS and Android versions, so treat this as a map rather than a promise.

Account type	Where the 2FA setting lives on the phone
Apple Account	Settings, tap your name, then Password & Security, or Sign-In & Security
Google Account	Settings, Google, Manage your Google Account, then Security
Samsung Account	Settings, Accounts and backup, Samsung account, then Security and privacy
Microsoft Account	Settings, Accounts, Microsoft account, then Security, or open it in the browser
Most apps and websites	Inside the app itself, usually under Settings, Security or Password and security

Step-by-Step: How to Turn On Two-Factor Authentication on a Phone

Before the platform-specific paths, here is the shape of it. Every account does the same four things in the same order.

Step 1: Open the account’s security page on the phone and find the two-factor or two-step verification option.

Step 2: Choose how you want to prove it’s you: a code from an authenticator app, a text message, a push notification, or a passkey.

Step 3: Confirm one code immediately, which registers this phone as a trusted device.

Step 4: Save the backup or recovery codes before you close the screen, and check that your recovery email address is one you can still open.

Menus, labels and screen names depend on the account provider, the phone operating system and the app version. If a label in this guide does not match your screen, look for the nearest equivalent rather than assuming the feature is missing.

How to Turn On Two-Factor Authentication on an iPhone

Apple turns on two-factor authentication automatically for an Apple Account, so on most modern iPhones you may find it already switched on. Here is how to check and how to manage it.

Open Settings and tap your name at the top of the screen. Below your Apple Account, tap Password & Security or Sign-In & Security, depending on your iOS version. You will see Two-Factor Authentication with a short explanation and a list of your trusted devices and phone numbers.

If the account was created on the web rather than on the iPhone, or you want to manage it from a browser, go to account.apple.com in Safari while signed in, choose Sign-In and Security, then Two-Factor Authentication under Account Security.

Two things to know here. Your iPhone settings control your Apple Account security, and they do not turn on 2FA for every other app on the phone. Banking, email and social apps keep their own switches, and you enable those inside each app or on its website.

Use the Manage next to your devices to remove an old iPhone, iPad or Mac you no longer use. Leftover trusted devices keep a line into your account.

How to Turn On Two-Factor Authentication on Android

Which Android path you need depends on whose account you are securing. A stock Pixel, a Samsung Galaxy and an account that lives only inside an app each have a different door.

Google Account on a Pixel or most Android phones: Open Settings, tap Google, then Manage your Google Account. Choose Security, scroll to How you sign in to Google, and tap Two-Step Verification. Follow the prompts, confirm your password, then verify a code from the method you picked.

On some Android versions the account is reached through Settings, Accounts, Account, Account security instead. Both routes open the same Google Account security page.

Samsung Account on a Galaxy phone: Open Settings, tap Accounts and backup, then Samsung account and Security and privacy. Tap Two-step verification and choose a method. Samsung offers a text message, an authenticator app, backup codes, and a Galaxy device notification that arrives as a push alert on another Samsung device you already own. These are separate settings, so enabling one does not enable the others.

Microsoft Account: On a phone, go to Settings, Accounts, Microsoft account and open Security, or sign in to your Microsoft account page in the browser and find Additional security and Two-step verification. Choose whether to get codes by text message or through Microsoft Authenticator.

Apps and websites: Open the app, tap your profile or the settings icon, look for Security, Login and security, or Password and security, then turn on two-step verification inside that screen. The menu name comes from the company, not from the phone.

Set Up an Authenticator App for Stronger Protection

An authenticator app is the better choice when you can pick one, because codes are generated on your device rather than sent over a network that can be intercepted. It also keeps working when you have no signal.

Install a well-known app from the official app store on your phone. There are several good ones, and the ones people in phone-help forums lean toward are the ones that can back up your tokens, because a wiped phone with no backup codes is a locked account.

Then, in the account’s security settings, choose authenticator app or the app’s name in the method list. The account shows a QR code with a short setup key underneath it.

Open the authenticator app, tap Add account or the plus button, and scan the QR code with the app’s scanner. If the camera cannot focus, enter the setup key by hand instead; both do the same job. The manual route matters on a phone that will not let you screenshot the QR code.

Rename the entry in the app to the account it belongs to, such as your email address or your bank. Six-digit codes for several accounts look identical otherwise, and you will not know which code goes where.

Enter the six-digit code the app displays into the account’s confirmation box. Codes rotate every 30 seconds, so type the current one and hurry. Once confirmed, the account is protected and the app will generate a new code every time you need it.

Test the Setup and Save Recovery Options

Turning 2FA on is not the same as knowing it works. Five minutes of checking now saves a lot of stress later.

Return to the account’s security page and confirm the setting shows as on. Most providers also flag trusted devices and the phone number or email holding the second factor, which is a quick visual confirmation.

Then download or screenshot your backup codes and store them in a password manager or print them and keep them somewhere secure. People on tech forums repeat the same advice constantly: save the codes before you think you need them, because the day you need them is the day the phone is gone.

Check that your recovery email address is one you can open without the phone in your hand, and add a second method while you still have full access. A backup email plus backup codes costs two minutes and removes the single point of failure.

Finally, sign in to a private browser window or another device using the account and confirm the prompt appears and accepts your code. On a phone you can usually trigger a prompt from the account security page instead, which is faster and does not risk a failed attempt on your main account.

Common Mistakes

You cannot find the option at all. On Android, the Google Account 2FA switch hides inside the account’s Security page, not inside the phone’s general security settings. On iPhone, Apple Account 2FA is often already on and has no visible toggle. For a specific app, you have to enable it inside that app.

You chose SMS out of convenience and regret it. Text codes are the weakest common option. They can be intercepted by SIM-swapping, redirected if your carrier account is compromised, and they fail whenever you have no signal. Adding an authenticator app as a second method costs five minutes and closes most of that gap.

You switched phones and lost access. This is the big one. Open the account’s security page from any browser while you still have access on the old device, remove the old phone from your trusted devices, and set up the new phone before wiping or trading in the old one. On many accounts the two-step verification page has a Change device or Manage devices option that walks through it. If the old phone is already gone, use your backup codes to sign in on the new device.

Your authenticator codes are rejected as invalid or incorrect. That usually means the phone’s clock has drifted. Time-based codes depend on the device time being right, so turn on automatic date and time in Settings, then wait a minute for the next code. Re-scanning the QR code fixes it too, though it creates a second entry in the app, so delete the old one.

Codes never arrive by text message. Check the trusted phone number on the account first. If it is an old number, update it from a device that is still signed in. If you are already locked out, request a backup code or use a trusted device. Repeated wrong attempts trigger a temporary block at some providers, and Samsung in particular holds text and voice verification for a stretch once a limit is hit, so stop guessing.

You saved backup codes before enabling 2FA, then reused an old printout. Backup codes are single-use. Once one has been entered, it stops working, and older printouts leave you with fewer working codes than you think. Print a fresh set after every change to your methods.

You enabled it on the wrong account. A Galaxy phone can carry a Google Account, a Samsung Account and a Microsoft Account at the same time, each with its own switch. Banking and social accounts add more. Open each account’s security page and confirm the toggle, rather than assuming one setup covered them all.

You assumed you could turn it off later. Apple does not let you switch two-factor authentication off once it is on for an Apple Account. Samsung does not allow disabling two-step verification for a Samsung account either. Google and Microsoft let you turn it off, but they require you to re-enter your password. Treat every one of these switches as a one-way door and prepare the recovery options first.

Passkeys as the Next Step

Once 2FA is running, it is worth adding a passkey to the accounts that support it. A passkey lives on your phone or in a password manager and unlocks sign-in with Face ID, Touch ID, Optic ID or a fingerprint instead of anything you have to remember or receive. Because there is no code to intercept and no server to send a code to, it removes several attack routes at once. It coexists with two-step verification rather than replacing it, and it also makes switching phones easier because passkeys sync through the password manager.

Frequently Asked Questions

Start with the account that matters most, usually your email, since it is the reset path for everything else. Save the backup codes first, confirm one code so the phone registers as trusted, and work through the rest one account at a time. That is the short version of how to turn on two factor authentication on a phone: about five minutes per account, done once.