Two-step verification asks for a second code after your password, so a stolen password alone is not enough. The code can come by text, from an authenticator app, a prompt on your phone, or a backup code.
The kinds of second step
- Text message: easy, but can be intercepted after a SIM swap.
- Authenticator app: a new 6-digit code every 30 seconds, works offline.
- Prompt or passkey: tap "Yes" on a signed-in device, or use your phone's screen lock.
- Security key: a physical key; the strongest option.
- Backup codes: one-time codes for when your phone is gone.
Set it up well
- Turn it on in the account's security settings.
- Choose an authenticator app or passkey first.
- Save the backup codes offline.
- Add text messages only as a backup.
When the code does not work
- Set your phone's time to automatic (authenticator codes depend on it).
- Use the newest text code only.
- Use a backup code if all else fails.
Guides for popular apps
Gmail, Instagram, Facebook, Discord, WhatsApp.
Common two-step problems
- Code rejected: the phone clock is off, or you typed an older code.
- No text arrives: filtered, roaming, or an old number on the account.
- New phone: the authenticator was not moved; use a backup code.
- Locked out: use the account's recovery process and expect a wait.
Two-step on a shared or work account
For team accounts, use a security key or a shared password manager with one-time codes, so access does not depend on one person's phone.
FAQ
Is two-step the same as two-factor?
Mostly yes; both add a second check after the password.
Which two-step method is safest?
A security key or passkey, then an authenticator app; text messages are the weakest.
What if I lose my phone?
Use a backup code, then set two-step up again.
Can I use a second number for two-step codes?
Only a number you keep long-term; never a one-time number.
Do I need two-step verification?
For email, money and social accounts, yes: it stops most account takeovers.
Can I use two-step without a phone?
Yes, with a security key, backup codes or an authenticator on a tablet or computer.
Related: verification code not received on any app · what is a verification code.
