How to: Enable Two-factor Authentication — by Electronic Frontier Foundation

intermediatepageLink only (©)

EFF's Surveillance Self-Defense guide ranks second-factor options from strongest to weakest and explains tradeoffs such as lockout risk and SMS weaknesses. It recommends securing email first, then cloud backup accounts, then everything else.

Quick steps

Set up a password manager with unique passwords first
Prefer passkeys or security keys, then authenticator apps, with SMS last
Save backup or recovery codes somewhere secure
Enable 2FA on email first, then cloud accounts, then social and other sites

Paraphrased from the source. Menus can differ by version, so check the original for full details.

Read the full article on ssd.eff.org

Source: How to: Enable Two-factor Authentication by Electronic Frontier Foundation. Licence: Link only (©).

Source reviewed: 2026-11-02
Link checked: 2026-11-02
Tested hands-on: Not by Oddbyte.Me

2fasecurity keyspasskeysprivacy

More in Passwords & 2FA

Creating Strong Passwords — by Electronic Frontier Foundation

beginnerpage

Part of EFF's Surveillance Self-Defense guide. It argues for a different password on every account to limit damage from leaks, with a password manager doing the work, and a random multi-word passphrase for high-value logins such as your device and the manager itself.

Managing your passwords — by NCSC (UK)

beginnerpage

Advice on using a unique strong password per account and why to enable two-step verification first. Describes how browser-based and third-party password managers store, generate and autofill passwords and can warn about breaches.

Three random words — by NCSC (UK)

beginnerpage

The NCSC shows how chaining three unrelated words makes a password that is hard to crack but still memorable. It also warns against personal details and predictable character swaps, and mentions password managers as an alternative.