Two-factor authentication for Gmail, Facebook and Instagram
Turn on 2FA under Security & sign-in in your Google Account and Password and security in Meta's Accounts Center, then save your backup codes.
UB Web Developers team
Two-factor authentication (2FA) asks for a second proof after your password, such as a code from an app or a tap on your phone. Turn it on for Gmail under Security & sign-in in your Google Account (opens in new tab), and for Facebook and Instagram under Password and security in Meta's Accounts Center (opens in new tab), then save the backup codes each one gives you. A passkey is a different way in: on Google, signing in with one skips both the password and the second step (Google (opens in new tab)).
With 2FA on, a stolen password is not enough on its own to get into your account.
Why isn't a strong password enough?#
A password can leak without you doing anything wrong. In 2019 Google said (opens in new tab) most of the account takeover attempts it saw "stem from automated bots with access to third-party password breaches": passwords stolen from other sites and tried on Google accounts. Others come from fake login pages.
In the same year-long Google study of extra sign-in checks, published in May 2019:
- a code sent by text message blocked 100% of automated bot attacks, 96% of bulk phishing attacks and 76% of targeted attacks
- a prompt on a signed-in phone blocked 100%, 99% and 90%
- none of the people who signed in only with security keys fell victim to targeted phishing
Which second step should I choose?#
Pick the strongest method each service offers that you will actually use.
- Passkey or security key. Google says (opens in new tab) passkeys "can't be shared, copied, written down, or accidentally given to someone else", which makes them more secure against phishing. CISA calls (opens in new tab) FIDO/WebAuthn authentication, the kind security keys use, "the only widely available phishing-resistant authentication".
- Authenticator app or phone prompt. Apps such as Google Authenticator make codes that work without internet or mobile service (Google (opens in new tab)). Google recommends its own sign-in prompts, because tapping is easier than typing a code. Instagram recommends (opens in new tab) an authentication app.
- Text message (SMS). The easiest to set up, and far better than nothing. But Google warns (opens in new tab) that "verification codes sent by texts or calls can be vulnerable to phone number-based hacks". Keep it as a backup method, not your only one.
Codes from an app or a text message can still be phished: CISA (opens in new tab) counts only FIDO methods as phishing-resistant. If you type one into a fake login page, the attacker can use it straight away. The fake pages in our hacked Facebook page guide asked for exactly these codes.
How do I turn on 2-Step Verification for Gmail?#
Google calls 2FA "2-Step Verification". The steps from Google's help page (opens in new tab):
- Open your Google Account at myaccount.google.com (opens in new tab).
- Select Security & sign-in.
- Under "How you sign in to Google", select Turn on 2-Step Verification.
- Follow the steps on screen.
If your address belongs to a work or school account, these steps might not work. Ask your administrator.
To add a passkey, go to myaccount.google.com/signinoptions/passkeys (opens in new tab) and select Create a passkey (Google (opens in new tab)). Create passkeys only on devices you own. Adding one doesn't remove your other sign-in or recovery methods.
How do I turn on two-factor authentication for Facebook?#
On a computer, from Meta's help page (opens in new tab):
- Click your profile picture at the top right, then Settings and privacy, then Settings.
- Click Accounts Center, then Password and security.
- Click Two-factor authentication, then the account you want to protect.
- Choose a method and follow the steps on screen.
Facebook offers three methods: a security key, codes from an authentication app, or codes by text message.
Facebook also supports passkeys for logging in to Facebook and Messenger, and may prompt you to create one (Meta (opens in new tab)). On a computer you need at least Windows 10, macOS Ventura or ChromeOS 109, or a security key that supports FIDO2. Don't create a passkey on a shared or public device.
How do I turn on two-factor authentication for Instagram?#
Instagram uses the same Accounts Center (Instagram Help (opens in new tab)):
- Open Settings. On a computer, click More at the bottom left, then Settings.
- Open Accounts Center, then Password and security.
- Select Two-factor authentication, then your Instagram account.
- Choose a method and follow the steps on screen.
Instagram offers an authentication app and text messages. Once text messages are on, you can also get codes on WhatsApp. You can only set up the app method in the Instagram app for Android or iPhone.
What if I lose my phone?#
Save your backup codes on the day you turn on 2FA. They are how you get back in without your phone.
- Google gives backup codes in sets of 10, and each works once. Find them under Security & sign-in > 2-Step Verification > Backup codes. A new set cancels the old one. Google suggests keeping them where you keep your passport (Google (opens in new tab)).
- Facebook gives 10 recovery codes, each usable once, under Two-factor authentication > your account > Additional methods > Recovery codes (Meta (opens in new tab)).
- Instagram has backup codes in the same place: Additional methods > Backup codes. Getting new codes cancels the old ones (Instagram Help (opens in new tab)).
Google's advice applies to all three: "Do not share your backup codes with anyone."
Does every admin of a business page need 2FA?#
Yes. People manage a Facebook page through their own personal accounts (Meta (opens in new tab)). So the page is only as safe as the least protected admin account: one admin without 2FA and with a leaked password is enough to lose it.
- Meta lets a business portfolio require two-factor authentication for the people in it. Its guide is How to turn on the two-factor authentication requirement in your business portfolio (opens in new tab).
- Meta's Advanced Protection (opens in new tab) is for higher-risk accounts, such as Page admin accounts of businesses that advertise with Meta. Meta requires it for some accounts, such as those connected to Pages with a large number of followers.
- If your email runs on Google Workspace, an admin can enforce 2-Step Verification under Security > Authentication > 2-step verification in the Admin console. Make sure everyone has enrolled first (Google Workspace (opens in new tab)). Google is also rolling out a 2-Step Verification requirement for every Workspace admin account, with 60 to 90 days' notice (Google Workspace (opens in new tab)).
If staff share logins to do their work, see how to send a password safely.
Sources#
- Google, Turn on 2-Step Verification (opens in new tab), Google Account Help
- Google, Sign in with backup codes (opens in new tab), Google Account Help
- Google, Sign in with a passkey instead of a password (opens in new tab), Google Account Help
- Google, Deploy 2-Step Verification (opens in new tab), Google Workspace Help, updated 22 October 2026
- Google, About 2SV enforcement for admins (opens in new tab), Google Workspace Help, updated 22 October 2026
- Kurt Thomas and Angelika Moscicki, New research: How effective is basic account hygiene at preventing hijacking (opens in new tab), Google Security Blog, 17 May 2019
- Meta, How two-factor authentication works on Facebook (opens in new tab), Facebook Help Center
- Meta, Set up Facebook login recovery codes (opens in new tab), Facebook Help Center
- Meta, Create a passkey on Facebook (opens in new tab), Facebook Help Center
- Meta, About Facebook Page access (opens in new tab), Facebook Help Center
- Meta, How to enable Advanced Protection on Facebook (opens in new tab), Facebook Help Center
- Meta, How to turn on the two-factor authentication requirement in your business portfolio (opens in new tab), Meta Business Help Center
- Meta, Securing your account with two-factor authentication (opens in new tab), Instagram Help Center
- Meta, How you can use a backup code on Instagram (opens in new tab), Instagram Help Center
- CISA, More than a Password (opens in new tab) (archived page)
Frequently asked questions#
Is two-factor authentication by text message (SMS) still worth turning on?#
Yes, if it is the only method you can use. CISA (opens in new tab) says "any MFA is better than no MFA", and in a Google study (opens in new tab) a text message code blocked 96% of bulk phishing attacks. Google (opens in new tab) also warns that text codes "can be vulnerable to phone number-based hacks", so add an app, a phone prompt or a passkey when you can.
What happens if I lose the phone with my authenticator app?#
Sign in with a backup code. Google (opens in new tab) and Facebook (opens in new tab) each give you 10 codes that work once each, and Instagram (opens in new tab) has backup codes in the same menu. Once you're in, set up the app on your new phone and get a fresh set of codes.
Does a passkey replace two-factor authentication?#
On Google, signing in with a passkey "bypasses your second authentication step", because it proves you have your device (Google (opens in new tab)). Facebook calls passkeys an alternative to your password for Facebook and Messenger (Meta (opens in new tab)). Keep 2FA on for the times you sign in with a password.
Can I make two-factor authentication mandatory for my staff?#
Yes, on business accounts. Meta lets a business portfolio require it for the people in it (Meta (opens in new tab)), and Google Workspace admins can enforce 2-Step Verification in the Admin console (Google (opens in new tab)). A personal Gmail account can't force it on anyone else.