Secure your email first: the account that protects all the others

If you only protect one account with two-factor authentication, make it your email. It's not the most obvious target, but it's the most important one to lock down.

Why email is the master key

Think about what "Forgot password?" does on every other site: it sends a reset link to your inbox. That means whoever controls your email can reset the password on your bank, your crypto exchange, your social accounts — everything. Your inbox is the skeleton key to your entire online life.

Turn on the strongest 2FA your provider offers

Open your email account's security settings and enable the authenticator app option rather than SMS where possible. It takes about a minute — you'll scan a QR code and start getting TOTP codes.

• Gmail / Google: Google 2FA guide
• Outlook / Microsoft: Microsoft 2FA guide
• Proton Mail: Proton 2FA guide

Then save your backup codes

Because email is so central, being locked out of it is especially painful. When you enable 2FA, immediately save the backup codes somewhere safe and separate from your phone.

After email, work down the list

Once your inbox is protected, secure your bank, your password-manager account, and anything financial next. Browse all setup guides →