Two-factor authentication, or 2FA, is an additional safeguard for your account. Alongside your password, the service asks for a second proof, such as a code from an app or a fingerprint. This guide shows how to set up 2FA step by step, which types of proof exist and what you should prepare for an emergency.
Short answer: Two-factor authentication adds a second proof to your password. The state cybersecurity agency of Baden-Württemberg recommends using 2FA whenever the service offers it. You will find the setup in the security settings of the respective account. No figures are involved here, only steps. Last updated: November 2026.
Key points at a glance
- Two-factor authentication combines two proofs, for example a password and a confirmation code.
- The Baden-Württemberg agency recommends using 2FA whenever the service offers it.
- Setup runs through the account security settings and usually takes a few minutes.
- A recovery route matters in case you lose your device or switch to a new one.
- After setup, test the login once and review the sign-in methods.
Which types of proof exist?
The factsheet distinguishes three kinds of proof that can be combined sensibly. Knowledge is something only you know. Possession is something you carry with you. An attribute is part of your body. Two-factor authentication combines two of them, for example a password and a code on your smartphone.
| Proof | Example | What to watch |
|---|---|---|
| Knowledge | Password or PIN | Must be strong and used only for this service |
| Possession | Confirmation code from an app or on a smartphone | Without access to the device you need the recovery route |
| Attribute | Fingerprint or facial recognition | Whether a service offers biometric methods depends on the device |
The factsheet describes the benefit this way: if a PIN or password is revealed, the data stays well protected as long as a second factor applies. That is where the value lies, because an intercepted password alone then does not open the account.
How do you set up 2FA step by step?
The interface differs from service to service, but the sequence is usually the same. The following order works with most providers, and you can transfer it to your own account.
- Open the security or account settings of the service and search for “two-factor authentication” or “two-step verification”.
- Choose the method you want to use, for example an authenticator app, a confirmation on a device or a security key.
- Follow the prompts, scan a QR code where required and enter the first code to confirm the connection.
- Secure the recovery option if the service offers one. Store the codes separately from your device.
- Sign in again to check that the second step works reliably.
When you scan a code, open the QR code directly from the service and do not take it from an unknown message. A fake page could otherwise trick you into entering your access data into a form that does not belong to the provider.
Which method suits you?
For most people, an app-based solution is the best middle ground. It also works without mobile reception and is harder to intercept than an SMS. Whether a service offers a security key or biometric methods is shown on its settings page. For important accounts, a combination of an app and a secured recovery route is worthwhile. If you manage many accounts, choose the methods as consistently as possible so that signing in does not become a hurdle in daily life.
What do you do if you lose the device?
The second factor often depends on one device. If you lose it, you may not be able to get into the account without a recovery route. That is why preparation is decisive. Note the recovery codes, keep them in a safe place and check whether you can store a second method. When you change devices, transfer the connection before you hand over the old one. Do not store the codes as an unencrypted text file in a cloud account that is protected only by the same password.
Checklist for setup
| Step | Done when |
|---|---|
| Check the service | You know whether 2FA is offered |
| Choose a method | You have decided on an app, a device or a key |
| Confirm the connection | The first code was accepted |
| Secure recovery | Codes are stored separately from the device |
| Test the login | A new sign-in with the second factor works |
A word on password choice: 2FA does not replace a good password. A long password used only for this service remains the foundation, and a password manager helps you keep track without memorising everything.
Frequently asked questions
Is two-factor authentication always necessary?
The factsheet recommends using 2FA whenever it is offered. It is especially worthwhile for accounts that hold money, contracts, university access or personal data. For less important accounts you can weigh the decision yourself, but a single password that is reused in several places is a risk in any case.
Which factor is the most secure?
There is no universal ranking. What matters is that the second factor suits you and that you know the recovery route. Biometrics are convenient but depend on the device. A code from an app is flexible but requires you to have the device with you.
What happens if I no longer receive the code?
First use the recovery route that the service offered during setup. If there is none, the provider’s support is often the only help, and the process then takes longer. That is why you should check the route in advance rather than in an emergency.
Does this also apply to accounts I rarely use?
Rarely used accounts often lack practice, and sign-ins with the second factor are quickly forgotten. Note in your password manager or on a separate sheet which method you chose, so that you are not left guessing later.
Does 2FA protect against phishing?
Two-factor authentication makes misuse of stolen access data harder. It does not protect against every deception, however, if you pass codes to a fake form. That is why you should check links before you sign in. The guide Phishing-Mail von der Bank: Woran du sie erkennst (in German) shows what to look for.
How to proceed now
- Check whether 2FA is available for your most important accounts.
- Set up the method that fits your everyday life.
- Store the recovery codes separately from the device.
- Test the sign-in and note where you find the setting.
What happens after setup?
After the first activation, it is worth looking at the overview of your signed-in devices and sessions. Many services show where you are still logged in. Remove entries you do not recognise and change your password if you suspect misuse. Setup is therefore not a one-time act but part of regular checks on your accounts.
Services also change their settings over the years. Review every six months whether two-factor authentication is still active and whether your recovery codes still apply. After a device change, a connection sometimes gets lost without you noticing right away.
Related reading
- Digital rights in everyday life: An overview for students (in German)
- Delete a social media account permanently
- Data breach at a service: What you should do now
- Phishing email from a bank: How to recognise it
Sources: Cybersicherheit Baden-Württemberg (CSBW): Factsheet on two-factor authentication, dated August 2023.
Last updated: November 2026. This guide is general information, not individual advice.
