Two-step login, also called multifactor authentication, asks for something more than a password when a person signs in. If someone has the password, the second check can still stop them. The National Cybersecurity Alliance advises turning it on for any account that offers it, and says to begin with email, money and work accounts.
The short answer. Two-step login asks for a second check after the password, such as a code from an app, a prompt or a fingerprint. The National Cybersecurity Alliance advises turning it on for every account that offers it, starting with email, money and work accounts, and never sharing the code. Google, Apple and Microsoft each publish their own steps.
Last reviewed 5 October 2026. Based on the National Cybersecurity Alliance, the United States Cybersecurity and Infrastructure Security Agency, and the help pages of Google, Apple and Microsoft. This is general information, not technical advice.
What it is
The National Cybersecurity Alliance article of 25 February 2026 describes multifactor authentication as an extra step when logging in: a code from an app, a code sent by text, a fingerprint or a face scan. It says that if someone steals a password, the second check can still keep them out, as long as the person does not share the code.
Where to start
The National Cybersecurity Alliance says to turn it on for any account that offers it, especially email, financial and work accounts. This next point is UtilForge’s own reasoning: email comes first, because the reset link for most other accounts goes to the email account, so whoever opens the email can often open the rest.
Which kind of second check
The National Cybersecurity Alliance lists app codes, texted codes, fingerprints and face scans, and advises using one on every account that offers it. The other sources compare the kinds:
- Google’s help page lists passkeys, security keys, Google prompts, authenticator apps and codes by text or call, says that passkeys give the strongest protection against phishing, and recommends prompts over text codes.
- The Cybersecurity and Infrastructure Security Agency’s mobile communications guidance of 18 December 2024 says that FIDO authentication is the strongest form of multifactor authentication, that text-message codes are not phishing-resistant, and that FIDO passkeys are an acceptable alternative to hardware security keys.
From these sources, UtilForge’s reading is that any second check is better than none, and that where an account offers an app, a prompt, a security key or a passkey, those are stronger than a texted code.
The official steps
Each company explains its own steps, and the pages change, so these links go to the source:
- Google: turn on 2-Step Verification. On a computer the page says to open the Google Account, choose Security and sign-in, and under “How you sign in to Google” choose Turn on 2-Step Verification.
- Apple: two-factor authentication for an Apple Account. Apple says it is the default for most accounts, and describes where to find it in Settings.
- Microsoft: two-step verification.
For any other service, the settings page usually has a heading such as Security, Sign-in or Login. The service’s own help page is the place to confirm the steps.
Keep a way back in
Google’s page lists backup codes, which are codes for emergency access. Whichever service is used, the recovery options are worth setting up while the phone is to hand. The National Cybersecurity Alliance article of 18 May 2026 says that many password managers can safely store other sensitive information, and keeping backup codes in one is UtilForge’s own suggestion.
The one thing never to share
The code that arrives by text or in an app is for the person signing in. The National Cybersecurity Alliance says the second check works as long as the code is not shared. This point is UtilForge’s own advice: a call, a text or a message that asks for the code is asking for the thing that protects the account, whoever it says it is from.
What a second check cannot do
This section is UtilForge’s own reasoning. A second check does not help if the person approves a sign-in they did not start, or reads a code out to someone who asks. A prompt on a phone that nobody expected is worth declining, and then worth changing the password for that account.
Sources
- National Cybersecurity Alliance, How to create strong passwords (and remember them!), 25 February 2026
- National Cybersecurity Alliance, What is a password manager?, 18 May 2026
- The Cybersecurity and Infrastructure Security Agency, Mobile Communications Best Practice Guidance, 18 December 2024
- Google Account Help, Turn on 2-Step Verification
- Apple Support, Two-factor authentication for Apple Account
- Microsoft Support, Two-step verification
Related guides
Free
Look again at your
password habits.
Password Habits Check asks six yes or no questions. You type no password, and nothing leaves your phone or computer.