Mark it once you can do it without this page open.

How to do it

  1. Open the security or sign-in section of your main email account's settings.
  2. Pick an authenticator app, a passkey or a security key over text message codes when you are offered a choice.
  3. Scan the setup code with the app or follow the passkey prompt, then type the first code to confirm.
  4. Print or write down the recovery codes and file them with your important papers.
  5. Repeat for your bank, phone carrier, cloud storage and any social account you care about.
  6. Sign out and back in once to make sure the second step works before you need it.

Common mistakes

  • Turning it on everywhere except the email account that resets all the others.
  • Saving recovery codes only on the same phone that holds the authenticator.
  • Tapping approve on a login prompt you did not start.

Quick self-check

Three questions. Your last score is kept in this browser.

1. Why start with your email account?
2. Where should recovery codes be kept?
3. A login approval appears on your phone and you are not signing in. What does it mean?

Teach this to someone

A one-page sheet for showing a friend, a roommate or a kid: what to say, what to show, and one question to check it landed.

Words on this page

Sources

  • National cybersecurity agency guidance for home users, 2026. Checked September 28, 2026.

Last reviewed . First published .