Set Up an Authenticator App With a Recovery Plan
Two-step verification only helps if you can recover when your phone is lost.
The aim is to help you complete one clear task, recognize what needs verification, and avoid the most common mistakes. Work through the checks in order, then use the real-world example to apply them to your situation.
This guide is designed as a practical decision checklist. Use the relevant official guidance alongside the steps, especially when rules depend on your country, device or individual circumstances.
1. Start with your primary email account
Open security settings on the official account website. Enable an authenticator-based second step when offered and keep your usual password strong and unique. Your email account is particularly important because password resets for other services often depend on it.
2. Understand where codes are stored
Some authenticators sync encrypted tokens while others keep them only on the device. Read the app documentation and decide whether your preferred recovery model uses secure sync, offline export or an extra enrolled device. Do not assume reinstalling restores codes.
3. Protect recovery codes separately
Download or write down backup codes using the service provider’s official workflow. Keep them in a protected location independent of your only phone. Avoid putting an unencrypted screenshot of codes in a public cloud album or sending it through email.
4. Test before an emergency
Sign out of a low-risk session and confirm you can sign in again. Review trusted devices, recovery numbers and alternative factors every few months. When replacing the phone, transfer tokens and test the new device before wiping the old one.
Verify the source before acting
For the definitions, current capabilities or rules behind this topic, use the original source below. Features, eligibility, safety requirements and local laws can change. A guide cannot replace a provider's official instructions or qualified advice for a consequential decision.