How to Set Up a Two Factor Authentication App on Your Phone

A two factor authentication app turns your phone into a second lock for your most important accounts. After you type your password, the site asks for a six digit code that only your phone can produce, and that code changes every 30 seconds. This guide is for anyone who still relies on text message codes, or who has never turned on extra sign in protection at all. Plan on about 15 minutes for the first account and two or three minutes for each one after that.

Why bother switching from texts? The FTC points out that codes from an app can't be stolen through a SIM swap or by someone who has broken into your email, which are two of the most common ways text codes get hijacked. A text code is still far better than nothing, but an app is the safer everyday choice.

Before you start setting up the app

Gather a few things first so you are not hunting for them halfway through:

• Your phone, updated to a recent version of iOS or Android
• The password for each account you plan to protect
• A computer or second screen, which makes scanning QR codes easier
• A safe place for backup codes, such as a password manager or a printed page kept at home
• About 15 minutes without interruptions

Stage one: pick and install an authenticator

1. Choose an app. The FTC names Google Authenticator, Microsoft Authenticator and Duo as examples. Any of them will do the job for most people, so pick the one you find easiest to use.
2. Install it from the Apple App Store or Google Play. Download it only from the official store listing, since copycat apps exist.
3. Keep it updated. Microsoft says it no longer supports Authenticator versions more than a year old, and Google notes that its code syncing feature needs version 6.0 or later on Android and 4.0 or later on iPhone.
4. Decide how your codes will be backed up. In Google Authenticator, signing in with your Google Account lets the app sync your codes across devices, and Google says they are encrypted in transit and at rest. If you prefer to keep codes only on the phone, Google offers a Use without an account option the first time you open the app. Just know that without a backup, a lost phone means a slower recovery.

Stage two: connect your first account

Start with your email account. Whoever controls your inbox can reset almost every other password you have, so it deserves protection first.

1. Sign in to the account on a computer and open its settings. CISA says the menu may be called Account Settings, Settings and Privacy or something similar.
2. Look for the security section and find the option labeled two factor authentication, two step verification or multi factor authentication.
3. Turn it on, and when the site asks how you want to receive codes, choose the authenticator app option.
4. The site will show a QR code on screen. Open your authenticator app, choose the option to add a new account, and point your phone's camera at the QR code.
5. The app adds the account and starts showing a six digit code. Type the current code into the website to confirm the link.
6. Save the backup codes the site offers. Google, for example, lets you print or download a set of 8 digit backup codes. Each one works once if your phone is ever unavailable.

Doing this for a Google Account

Google's own path is short. Open your Google Account, go to Security & sign-in, and under "How you sign in to Google" choose the option to turn on two step verification, then follow the prompts. To add the app, go to the authenticator page in those settings (the Google Authenticator help page links straight to it) and tap Set up authenticator. On some devices the button reads Get Started. Google warns that it can take up to 7 days before Authenticator shows up as a sign in option. For more settings worth changing at the same time, see our guide to securing your Google account.

Stage three: add the rest of your accounts

Once email is done, repeat the same steps for every account that holds money or personal data. The FTC suggests starting with:

1. Your bank and credit card accounts
2. Social media profiles
3. The website you use to file taxes
4. Payment apps

Some services skip the QR code and give you a long text key instead. In that case, choose the manual entry option in your app and paste or type the key exactly as shown.

If an account offers only text message codes, use them anyway. The FTC calls that better than nothing.

Stage four: protect your codes for the long run

A few habits keep this setup from turning into a lockout later:

• Turn on a privacy lock. In Google Authenticator, go to Menu, then Settings, then Privacy Screen, so someone holding your unlocked phone can't read your codes.
• Move codes before you switch phones. If your codes are not synced, use Transfer codes in the old phone's menu, then Export codes, pick the accounts, and tap Next. On the new phone, open the menu, choose Transfer codes, then Import codes, and scan the QR code shown on the old phone. If you sync with your Google Account, signing in on the new phone brings the codes over automatically.
• Never read a code to anyone. The FTC warns that scammers try to talk people into handing over verification codes. If someone you didn't contact first asks for one, it's a scam. Our explainer on phishing shows the tricks they use.
• Don't delete codes in a hurry. Google notes that deleting a synced code removes it from every synced device.

When setup doesn't work

The code is rejected. Codes depend on your phone's clock. Google says version 7.0 of its app dropped the old time correction setting and now relies on your phone's system time, so open your phone's date and time settings and make sure the time is set automatically. Then wait for a fresh code and type it quickly.

The QR code won't scan. Zoom the web page so the code fills more of the screen, clean the camera lens, or use the manual key option instead.

Your new phone shows no codes. If you used the app without an account and never exported your codes, they did not travel with you. Sign in with one of your saved backup codes, then set up the app again for that account. Without backup codes, you will need each service's account recovery process, which is usually much slower.

Your phone was lost or stolen. Google suggests remotely erasing the device. If your codes were synced, remove the lost phone from your Google Account so it can no longer produce them, then reset the app on a new phone.

Where to go from here

An authenticator app is a big step up from text codes, but it isn't the top of the ladder. The FTC calls security keys the strongest form of two factor authentication, and CISA promotes phishing resistant options for accounts that matter most. Passkeys work along similar lines, and our explainer on what a passkey is covers how they compare. If you would rather tackle everything in one sitting, our checklist to protect your online accounts in 10 minutes pairs well with this guide, and you can find more security help in our tech section.

One last check: sign out of your email on the computer and sign back in. If the site asks for a code and the app supplies one that works, your setup is done.