An authenticator app is one of the best security upgrades you can make for free. Setup takes a couple of minutes per account. This how-to is part of our two-factor login and passkeys guide.

What you need

  • Your phone.
  • Access to the account you want to protect.
  • A pen and paper for backup codes.

Step 1: Choose an app

Well-known options include Google Authenticator, Microsoft Authenticator, Authy, Aegis (Android) and the built-in Passwords app (Apple). Any reputable one works. Get it from your phone's official store, and check the publisher, because fake authenticator apps exist.

Step 2: Open your account's security settings

Log in on a computer. Go to Settings, then Security or Password, then look for two-factor authentication, two-step verification or 2FA. Choose "Authenticator app".

Step 3: Scan the QR code

Open the authenticator app, tap add, and scan the QR code on your screen. The account appears in your app with a six-digit code that changes every 30 seconds.

Step 4: Confirm it

Type the current code into the website. If it fails, wait for a new code, and check that your phone's clock is set automatically.

Step 5: Save your backup codes

This is the step people skip and later regret. Write down the backup codes and keep them somewhere safe, away from your phone. If you lose your phone, these get you back in. See what to do with backup codes.

Which accounts to add first

Start with your email, then follow our list of which accounts need 2FA first.

Avoid these mistakes

  • Sharing a code. Nobody genuine will ever ask you for one. If someone asks, it is a scam. Read about fake security alerts.
  • Screenshotting the QR code. It contains the secret, so treat it like a password.
  • Relying on one phone with no backup. Turn on your app's backup feature if you trust it, or keep backup codes on paper.