How to turn on two-factor in WhatsApp, Instagram and Gmail

Before touching any menu, two minutes of preparation that save a lot of grief.

Install an authenticator app. Google Authenticator, Microsoft Authenticator, Aegis, 2FAS, or whichever one your password manager includes. They all do the same thing: generate a six-digit number that changes every thirty seconds, with no connection required.

Decide where the recovery codes are going to live. Each service hands you a list of one-time codes when you enable verification. They are the master key for the day you lose your phone. Put them in your password manager, or printed in a drawer. Anywhere except the phone itself, which is precisely the thing you might lose. The long reasoning is in you lost the phone with your two-factor codes.

The order matters

Do not enable all three at once without thinking. Work in this order:

1. Email. The root account. Everything else resets through it.
2. Banking and payments, if they do not already require it.
3. Social media, where your identity gets impersonated to your contacts.
4. Everything else.

Gmail and your Google account

The Google account is the most important of the three, because your email, photos, Android phone and the recovery path for almost everything else hang off it.

1. Open your Google account in a browser, or Settings → Google on the phone.
2. The Security tab.
3. Find 2-Step Verification and switch it on.
4. Google defaults to prompts on your phone. That works well, but scroll down to Authenticator app and add that too: it is what saves you if that phone is gone.
5. On the same screen, Backup codes. Generate and store them now, not “later”.

If you want to go a step further, Google supports passkeys, which replace the password with your device’s fingerprint or face. What they are exactly, and whether it is worth switching, is in passkeys: what they are and how they work.

WhatsApp: the PIN, which is not what it looks like

WhatsApp works differently, and this trips people up. There is no password: the account is tied to your phone number and verified by SMS. Which means whoever gets your number gets your WhatsApp.

WhatsApp’s two-step verification is a six-digit PIN requested when your number is registered on a new phone. It is the only thing standing between a SIM swap and your conversations.

1. Settings → Account → Two-step verification.
2. Turn on.
3. Pick six digits that are not your date of birth or your card PIN.
4. Add a recovery email address. Without it, forgetting the PIN locks you out of your own account for days.

Nobody from WhatsApp will ever ask for that PIN or for your registration code. This is exactly the scam described in SMS codes you never asked for: someone messages you posing as a friend, says they sent you a code by mistake, and asks you to forward it.

Instagram

1. Settings → Accounts Centre.
2. Password and security → Two-factor authentication.
3. Pick the account and choose Authentication app.
4. Scan the code with your authenticator app and enter the six digits.
5. Save the recovery codes that appear next.

Instagram and Facebook share the Accounts Centre, so if both are linked, enabling it covers the pair. While you are on that screen it is worth reviewing where you are logged in and ending anything you do not recognise — the step most people skip, and the one that actually evicts anybody already inside, as explained in someone got into my Instagram.

After enabling it: the test

The step almost nobody does, and the one that prevents the nasty surprise:

1. Sign out on one device.
2. Sign back in and check the code works.
3. Check you know where your recovery codes are.

If something is wrong, it is infinitely better to find out now, while you are still signed in somewhere else, than in six months with a broken phone.

What not to do

• Do not store the recovery codes only on the phone that generates the codes.
• Do not use SMS as your only method if the service offers an app.
• Do not screenshot the QR code and leave it in your gallery: anyone with access to your photos could rebuild your second factor.
• Do not turn verification off “just for a minute” to do something quickly. It rarely goes back on.

The short version

• Save the recovery codes before enabling anything, and not on the phone.
• Start with email: it is the account everything else recovers through.
• WhatsApp’s two-factor is a PIN, and its job is to block a takeover of your number.
• On Instagram, enabling two-factor and ending unknown sessions belong together.
• Test that it works the same day, not when you need it.