---
title: "What Is Two-Factor Authentication (2FA)? How to Turn It On"
description: "Two-factor authentication (2FA) asks for a second proof, such as a code or a tap on your phone, after your password. How it works and how to turn it on."
url: https://proxynet.io/blog/what-is-two-factor-authentication
date: 2026-11-15
author: "Acar Diveroli"
category: "Proxies"
lang: en
---

# What Is Two-Factor Authentication (2FA)? How to Turn It On

An email arrives: someone signed in to your account from a device you have never owned, in a city you have never visited. If the password was the only lock, that person is now reading your messages. With two-factor authentication turned on, the password is not enough: the stranger would also need your phone, your security key or your fingerprint.

This post explains what two-factor authentication (2FA) is, how a 2FA sign-in works, which methods exist and how strong each is, and where to turn it on for Google, Apple, Instagram, Facebook and WhatsApp. It also covers backup codes and a lost phone; getting back into an account goes only through the platform's official recovery steps.

> **Note: Short answer**
>
> Two-factor authentication (2FA) is a sign-in check that asks for two different kinds of proof: something you know, such as a password, and something you have or are, such as your phone, a security key or your fingerprint. After the password, the site asks for a one-time code by text or from an authenticator app, a tap on a prompt on your phone, or a passkey, so a stolen password alone no longer opens the account. Turn it on in each account's security settings (Google: Security & sign-in; Apple: Sign-In & Security; Instagram and Facebook: Accounts Center), save the backup codes away from your phone, and prefer an app, a passkey or a security key to SMS.

## What is two-factor authentication?

Two-factor authentication is a way of signing in that requires two proofs of different kinds, so one stolen or guessed secret is not enough to get into your account. Security standards sort these proofs into three factors: something you know (a password or PIN), something you have (a phone or a security key) and something you are (a fingerprint or your face).

A cash machine is the everyday example: it wants your bank card, which you have, and your PIN, which you know. A thief who sees the PIN still needs the card. Online, the password plays the part of the PIN and your phone or security key plays the card.

The proofs must be of different kinds: a password plus a security question is two things you know. The US National Institute of Standards and Technology (NIST) also counts a fingerprint only together with a device; its [digital identity guidelines](https://pages.nist.gov/800-63-4/sp800-63b.html) state that a biometric is not an authenticator by itself. Your fingerprint unlocks your phone, and the phone proves to the website that it is you.

## How does a 2FA login work?

A 2FA login adds one step after the password, and the site checks both answers before it lets you in:

1. **You enter your username and password.** This is the first factor, something you know.
1. **The site sees that 2FA is on.** Instead of opening the account, it asks for the second proof.
1. **Your second factor produces a one-time answer.** A code arrives by text, an app calculates one, a prompt appears on a phone that is already signed in, or your device answers with a passkey.
1. **You enter the code or approve the prompt.** A code works once and only for a short time, so a copy found later is useless.
1. **The site signs you in.** It may offer to remember the device, as Google does with **Don't ask again on this computer**, so the password is enough there next time.
1. **A new device starts again at step 1.** Apple, for example, asks for a code the first time you sign in on a new device or on the web.

## What types of two-factor authentication are there?

Five second factors are common, and they differ mainly in how easily someone can intercept them or trick you out of them:

| Method | How it works | Weak point | Good for |
|---|---|---|---|
| SMS or voice code | A six-digit code sent to your number | SIM swap, fake login pages | Services that offer nothing else |
| Authenticator app | Your phone calculates a new code every 30 seconds | Fake login pages | Most accounts |
| Push prompt | You tap Yes on a phone that is signed in | Approving a prompt you did not start | Google, Microsoft and similar accounts |
| Passkey | Your device unlocks a key tied to the site | Losing every device that holds it | Any account that offers it |
| Security key | A small key you connect to your device | Losing it without a spare | Work and high-risk accounts |

**SMS codes** are the easiest to set up and the easiest to steal. Google warns that codes sent by text or call can be vulnerable to phone number-based attacks, and NIST lists the phone network as a "restricted" channel for them. They are still far better than a password alone.

**Authenticator apps** create time-based one-time passwords (TOTP), defined in [RFC 6238](https://www.rfc-editor.org/rfc/rfc6238). During setup the site shows a QR code holding a secret key; from then on the app and the site each combine that key with the current time and arrive at the same code, a new one every 30 seconds. Nothing is sent to your phone, so the app works without signal.

**Push prompts** appear on a phone that is already signed in; you check the device and location shown and tap Yes or No. Google says they also help against SIM swaps. Approve only a sign-in you started a moment ago.

**Passkeys and security keys** replace the code with cryptography. The FIDO Alliance describes a [passkey](https://fidoalliance.org/passkeys/) as a credential based on FIDO standards, stored on your phone or computer and unlocked with the fingerprint, face or PIN that unlocks the device. The device gives the site only a proof made for that site, so a fake login page receives nothing it can reuse. A passkey is two factors in one step, which is why Google skips the separate second step when you use one; a hardware security key does the same job on your key ring.

## 2FA vs two-step verification vs MFA: what is the difference?

In everyday use all three mean a second check after the password; they differ in what counts as the second check.

- **Two-factor authentication (2FA)** strictly means two different factors, such as a password and a phone.
- **Two-step verification** means two steps, which need not be different factors. Google calls its feature 2-Step Verification and describes it as two-factor authentication in the same sentence.
- **Multi-factor authentication (MFA)** means two or more factors. 2FA is its most common form, and work accounts usually use the broader name.

The method behind the name matters more: a passkey holds up against fake login pages, a code does not.

## How do you turn on two-factor authentication?

You turn it on in each account's security settings; the paths below are the ones the services publish. Save the backup codes as soon as they are offered.

### Google Account (Gmail, YouTube)

Open your Google Account, select **Security & sign-in**, and under **How you sign in to Google** select **Turn on 2-Step Verification**, then follow the steps. Google [recommends](https://support.google.com/accounts/answer/185839?hl=en) its prompts as the second step if you do not sign in with a passkey; the same page adds an authenticator app, a security key and backup codes.

### Apple Account (iPhone, iPad, Mac)

Most Apple Accounts already use two-factor authentication. Open **Settings** on an iPhone or iPad (**System Settings** on a Mac), tap your name, then **Sign-In & Security**; if it is off, turn it on there. On the web, sign in at account.apple.com and choose **Upgrade Account Security**. Apple's [help page](https://support.apple.com/en-us/102660) explains the six-digit codes that appear on your trusted devices.

### Instagram and Facebook (Accounts Center)

Both use Meta's Accounts Center. In Instagram, open **Settings**, then **See more in Accounts Center** > **Password and security** > **Two-factor authentication**. In Facebook, select your profile picture > **Settings and privacy** > **Settings** > **Accounts Center** > **Password and security** > **Two-factor authentication**.

Instagram offers an authentication app (its recommended method), text messages, or WhatsApp once text messages are on; Facebook offers an authentication app, text messages or a security key. Turning a method off follows the same path; do it only to replace the method with a stronger one.

### WhatsApp

WhatsApp's two-step verification adds a password you set on top of the phone number you register with. Go to **Settings** > **Account** > **Two-step verification** > **Turn on two-step verification**, create the password and add an email address you can reach. WhatsApp is replacing the old six-digit PIN with a full password, and since August 2026 someone who uses both Android and iPhone can add more than one passkey under **Settings** > **Account** > **Passkeys**.

## What are backup codes, and what if you lose your phone?

Backup codes are one-time codes you save in advance so you can still sign in when your phone is lost or broken. Google gives a set of 10 eight-digit codes, each usable once; Facebook offers 10 recovery codes. Print them and keep the paper with your passport, or store them in a password manager you can open without this phone; [What Is a Password Manager?](/blog/what-is-a-password-manager) explains how that vault is locked.

If the phone is gone, work through these steps in order:

1. **Use another way in.** A second phone signed in to the account, a backup code, a security key or a passkey on another device; on Google's sign-in screen they sit behind **Try another way**.
1. **Try a trusted device.** A computer where you ticked "Don't ask again" may let you in with the password alone.
1. **Secure the account.** Sign the lost phone out, change the password and add your new phone.
1. **Get your number back.** Your mobile carrier can move the number to a new SIM card, which brings text codes back.
1. **Use the official recovery flow if nothing else works.** Google says recovery can take 3-5 business days without another second step; Apple's account recovery can take several days or longer, and Apple Support cannot shorten it.

Ignore anyone who offers to unlock an account for a fee: Google states that it does not work with any service that claims to provide account or password support.

## Is two-factor authentication safe?

Yes: any kind of 2FA makes an account much harder to take over than a password alone, but codes can still be stolen, so the method matters.

**SIM swap.** A criminal persuades your mobile carrier to move your number to a SIM card they hold, and your text codes go to them. That is why NIST restricts codes sent over the phone network. Ask your carrier about an account PIN or a lock on number transfers.

**Phishing.** A fake login page can ask for your code as well as your password and use both at once, and a caller can talk you into reading out a code. Codes cannot tell a real site from a copy; passkeys and security keys can. [What Is Phishing?](/blog/what-is-phishing) shows how to recognise those pages and calls.

**After the login.** 2FA guards the sign-in, not the session that follows: malware can steal the session cookie a site hands you afterwards, so keep devices updated and end sessions you do not recognise.

## Why do you get asked for a code again on a new device or network?

Services ask again when a sign-in looks new: a new phone, a browser with cleared cookies, a device you never marked as trusted. Many also notice where a sign-in comes from; Google's security alerts show the device type, time and location of a new sign-in.

This matters for teams that manage accounts through proxies, such as an agency running clients' social media. If the address changes on every request, each sign-in looks like a stranger in a new place, and the account owner gets repeated checks. Keep one consistent address per account, through a sticky session that holds one address for a set time or a dedicated static address; [How to Manage Multiple Social Media Accounts Safely](/blog/manage-multiple-social-media-accounts) covers the rest of that setup.

An [ISP Proxy](https://proxynet.io/static-isp-residential-proxy) gives each account a dedicated address registered to an internet provider, limited by default to the target sites you choose. A stable address does not switch 2FA off: the code is still asked on every new device, which is what keeps the account safe.

## Where you meet two-factor authentication

On the code screen after your password when you sign in to email on a new laptop. In a prompt on your phone asking whether it is you. In a text message with a one-time code from a bank or a government service. At work, in the authenticator app or security key your company hands out.

## Common mistakes

- **Not saving backup codes.** A lost phone then turns into a recovery process of several days.
- **Keeping backup codes only on the phone.** They are meant for the day that phone is gone.
- **Reading a code out to a caller.** Google says it will never call you to verify a code.
- **Tapping Yes on a prompt you did not start.** Tap No and change your password; someone probably has it.
- **A wrong clock on the phone.** Google Authenticator uses your phone's time setting, so set date and time to automatic.
- **Wiping the old phone before moving your codes.** Transfer the authenticator codes or add the new phone first.

## Decision guide

| Your situation | What to use |
|---|---|
| You want the simplest strong option | A passkey wherever the service offers one |
| The service offers only codes | An authenticator app rather than SMS |
| Your Google Account | Google prompts or a passkey, plus printed backup codes |
| An iPhone, iPad or Mac | Apple two-factor authentication, usually on already |
| Instagram or Facebook | An authentication app in Accounts Center, plus recovery codes |
| WhatsApp | A two-step verification password with an email address |
| A team that signs in to client accounts | The client keeps the backup codes; one stable address per account |

## Frequently asked questions

### Should I turn off two-factor authentication?

No, unless you are replacing it with a stronger method. Turning it off makes the password the only lock again, and Google warns that this can make it easier for someone else to get in. If the code screen annoys you, mark your own devices as trusted or switch to a passkey; an Apple Account created with two-factor authentication cannot turn it off at all.

### Is SMS two-factor authentication safe?

It is much safer than a password alone, but it is the weakest kind of 2FA: text codes can be redirected through a SIM swap or typed into a fake page. Use an app, a passkey or a security key for email and banking, and SMS only where nothing else is offered.

### What is a 2FA code?

A 2FA code is a short one-time number, usually six digits, that proves you hold the second factor. It arrives by text or call, or an authenticator app calculates it, and it works once and only briefly. Never share one.

### Can two-factor authentication be hacked?

Yes, but it is much harder than stealing a password. The weak points are fake login pages that pass your code on at once, SIM swaps, people talked into approving a prompt, and malware that takes over a session after sign-in. Passkeys and security keys shut out the first three: there is no code to pass on, no text to redirect and no prompt to approve.

### Which authenticator app should I use?

Any app that supports standard time-based codes works with most sites. Google Authenticator and Microsoft Authenticator both create them, and from iOS 18 and macOS Sequoia Apple's Passwords app stores verification codes too; many other apps exist. Pick one that can move your codes to a new phone, as Google Authenticator does by syncing them to your Google Account.

### Why is my 2FA code not working?

Usually the code has expired, belongs to a different account, or the phone's clock is off. Google's checklist: enter the code before it expires, check that it is for the right app and account, and make sure your device's time is synced and correct for your time zone. If a text code never arrives, use a backup code.

## Summary

Two-factor authentication asks for a second, different proof after your password, so a stolen password alone no longer opens your account. Turn it on first for your email, because your other accounts' password resets go through it, then for Google or Apple, social media and WhatsApp. Prefer a passkey or an authenticator app to SMS, keep backup codes away from your phone, and recover a locked account only through the platform's own steps. If your team signs in to client accounts through proxies, our [proxy services](/proxy) page compares the sticky and static options.