Short answer
Two-factor authentication (2FA) asks for a second proof — a code, an app prompt or a security key — when someone signs in from a new device. Turn it on in each account’s security settings and, the same day, save the backup: Google and Facebook give you 10 single-use codes, Instagram has backup codes, X up to 5, Microsoft a recovery code, Snapchat a recovery code, Discord backup codes, Telegram a recovery email and WhatsApp an email for resets. LinkedIn asks for an ID check if you lose the phone. Prefer an authenticator app, security key or passkey over text messages. The table lists the exact path on each platform.
Where to turn it on, platform by platform
| Platform | Where to turn it on | Backup if you lose your phone | Good to know |
|---|---|---|---|
| Google Account → Security → 2-Step Verification | 10 single-use backup codes | A new set of codes cancels the old one | |
| Apple | Settings → your name → Sign-In & Security → Two-Factor Authentication | Trusted phone number; a recovery key or recovery contact | Most Apple Accounts already have it on |
| Microsoft | account.microsoft.com/security → Manage how I sign in → Two-step verification | A recovery code (a new one replaces the old) | Don’t store the code on a device you sign in with |
| Accounts Center → Password and security → Two-factor authentication | Backup codes under Additional methods | You must be logged in to see or renew them | |
| Accounts Center → Password and security → Two-factor authentication | 10 recovery codes, each usable once | New codes cancel the previous set | |
| Settings → Account → Two-step verification | An email address for resetting it | WhatsApp is upgrading the 6-digit PIN to a password | |
| TikTok | Settings and privacy → Security → 2-step verification | Choose at least two methods: phone, email or authenticator app | A reset from an unrecognised device may be blocked |
| X | Settings and privacy → Security and account access → Security → Two-factor authentication | Up to 5 backup codes, used in order | Text-message 2FA is only for Premium subscribers |
| Settings & Privacy → Sign in & security → Two-step verification | Without your phone: an identity check with a government ID | Turning it off forgets recognised devices | |
| Snapchat | Settings → My Account → Two-Factor Authentication | A recovery code | Logging in with it turns two-factor off — switch it back on |
| Telegram | Settings → Privacy and Security → Two-Step Verification | A recovery email | Without one, a password reset takes 7 days |
| Discord | User Settings → My Account → enable an authenticator app | Single-use backup codes | Discord can’t remove MFA or issue codes for you |
Menu names change with app updates; each platform’s official page is listed under Sources.
Which method to choose
- Authenticator app (Google Authenticator, Microsoft Authenticator and similar): works offline and can’t be redirected by a SIM swap.
- Security key or passkey: the strongest option where offered — passkeys explained.
- Text message: better than nothing, but a hijacked number receives your codes — SIM swap: what to do.
Save the backup the same day
- Generate the backup codes or recovery code as soon as 2FA is on.
- Store them where you can reach them without that phone — a password manager or a printed copy at home.
- Each code works once; a new set cancels the old one on Google, Facebook and Microsoft.
- Keep a second recovery method current: a backup phone or email.
Already locked out?
Use a backup code if you have one. If not, each platform has its own route — some need an ID check, some a waiting period: lost access to two-factor authentication and recovery wait times.
After you turn it on
Check which devices are already signed in and end the ones you don’t know — turning on 2FA may not end sessions that are already open: who else is logged in? The rest of the routine is in our 15-minute security checklist; our hacked account recovery service works only through official channels.
Frequently asked questions
How do I turn on two-step verification on Google?
Google Account → Security → 2-Step Verification, then follow the steps. Afterwards create backup codes in the same section.
Where are my Instagram backup codes?
Accounts Center → Password and security → Two-factor authentication → your account → Additional methods → Backup codes. You must be logged in.
What if I lose my phone with two-factor authentication on?
Sign in with a backup code or your other method. Without one, follow the platform’s recovery — LinkedIn, for example, asks for a government ID.
Is SMS two-factor authentication safe?
It’s better than none, but SIM swapping can redirect texts. An authenticator app, security key or passkey is safer.
Sources: Google Account Help — turn on 2-Step Verification, Google Account Help — sign in with backup codes, Apple Support — two-factor authentication for Apple Account, Microsoft Support — two-step verification, Microsoft Support — get a recovery code, Instagram Help — secure your Meta account with two-factor authentication, Instagram Help — use a backup code, Facebook Help — set up login recovery codes, WhatsApp Help — manage two-step verification, TikTok Support — account safety, X Help — two-factor authentication, LinkedIn Help — turn two-step verification on and off, LinkedIn Help — no access to your device, Snapchat Support — use a recovery code, Telegram — FAQ, Telegram — two-step verification (API documentation), Discord Support — set up multi-factor authentication, Discord Support — lost two-factor codes