How to Set Up 2FA on Every Account in One Afternoon

It often takes a scare to get serious about two-factor authentication. A reused password turns up in a credential dump from some forgotten forum breach, an inbox gets hijacked and starts firing phishing links at everyone in the contact list, and suddenly the abstract risk feels very concrete. In most of those cases, two-factor authentication (2FA) would have stopped the attack cold. The problem is rarely that people don't know about it. It's that securing every account at once feels like a project too big to start.

It doesn't have to be. With a focused afternoon, you can work through every account you own — not just the obvious ones like email and banking, but the weird edges: the cooking forum from 2019, the newsletter platform you trialed and abandoned, the cloud storage service from a startup that may have already gone under. Here's a practical, step-by-step way to do it, including the traps that tend to catch people off guard.

Step One: The Account Audit (This Part Takes Longer Than You Think)

Before you can secure anything, you need to know what you actually have. Open a plain text file and start listing accounts. A reliable method: search your email inbox for phrases like "welcome to," "verify your email," and "confirm your account." Sorting by sender gives you a rough map of your digital life going back years.

The count usually surprises people. It's common to pass sixty recognized services before you even stop counting the dormant ones — and to find that thirty or forty of them have a login you genuinely use or care about. That's the realistic scope of a modern person's account surface. Not three accounts. Closer to forty.

Make three columns: the service name, whether you still use it, and whether it even supports 2FA. That last column is often the depressing one. A handful of smaller services — a hobby forum, a regional utility's billing portal, an older tool from a small company — may have no 2FA support at all. There's nothing to do there except use a strong, unique password (more on that later) and accept the residual risk.

Picking an Authenticator App (And Why the Obvious Choice Isn't Always Best)

The first instinct for many is to reach for Google Authenticator simply because the name is familiar. It's worth pausing on the backup situation first. For years, if you lost your phone, you lost every code stored in that app, with no way to recover them unless you'd screenshotted the QR codes during setup — which largely defeats the purpose of keeping them safe.

Google eventually added cloud backup, but single-vendor lock-in is still a reasonable concern. A strong alternative on Android is Aegis Authenticator — open source, with encrypted local backup, and the ability to export the vault as an encrypted file that slots into your regular backup routine. On iOS, Raivo or the built-in Apple Passwords app (added in iOS 18) are solid choices.

The important thing: whatever app you pick, do a test restore before you rely on it. Export your vault, pretend your phone is gone, and confirm you can actually get back in. Checking this early, before any real lockout, is far less stressful than discovering a broken backup in a crisis.

The Enrollment Process — Account by Account

Work through a priority list in order: email first, then your password manager, then financial accounts, then work tools, then everything else.

Email is the most important. If someone controls your email, they can reset almost anything else. Enabling 2FA on a typical Gmail account takes only a few minutes. The surprising part is that Google's "2-Step Verification" page lists every backup method you've ever added — old phone numbers, backup codes from years ago, recovery email addresses. It's common to find a stale phone number in there from years back. Delete anything you no longer control.

The password manager enrollment can feel paradoxical — using one security tool to protect another — but it's exactly right. If your password manager is compromised, everything else falls with it. Tools like Bitwarden let you set up TOTP (Time-based One-Time Password, the standard behind those six-digit codes that refresh every thirty seconds) along with an emergency-access feature. Plan to print a recovery sheet, seal it in an envelope, and store it in a physical folder. Old fashioned, but reliable.

Banks are often inconsistent. Some accounts — credit unions in particular — only offer SMS-based 2FA. That's better than nothing, but SMS has real weaknesses: SIM-swapping attacks, where someone convinces your carrier to transfer your number to a new SIM, can intercept those codes. It's worth enabling anyway, since it raises the bar significantly over a password alone, but note it as a weaker link.

A proper authenticator-app option, when a bank offers one, is frequently buried several menus deep under "Security Settings" or "Advanced." It's easy to miss, so look carefully before settling for SMS.

Backup Codes: The Part Most People Skip

Every service that supports TOTP also offers backup codes — a set of one-time-use codes you download during setup, typically eight to ten of them, that let you in if you lose your authenticator. Most people generate these, think "I'll save them somewhere later," and then lose them.

One sound system: save each service's backup codes as a text file named after the service, collect them in a folder, then encrypt that folder with a tool like VeraCrypt using a passphrase you have memorized. The encrypted volume can live in cloud storage and on a USB drive at home, while the passphrase lives only in your head and in your password manager.

That's more elaborate than most people need. At minimum: print them, write the service name on the paper, and put them somewhere physically safe. A fireproof box is good. A sock drawer is not.

The Gotchas Worth Knowing About

A few things tend to catch people off guard going in.

The clock problem. TOTP codes are time-synchronized — your phone's clock and the server's clock need to roughly agree. A device with automatic time sync turned off can drift several minutes, and the codes it generates will be consistently rejected. Turning on automatic time sync fixes it instantly, but it's an easy issue to chase for far longer than it should take.

App-specific passwords. When you enable 2FA on email, some older desktop apps may stop working. Gmail and others handle this by generating "app-specific passwords" — one-time passwords for applications that can't use the normal 2FA flow. Setting these up for a mail client or calendar app can add fifteen minutes you didn't budget for.

The service that locks you out on setup. Occasionally a service lands you in a state where it demands a 2FA code before you've finished enrolling one. A backup code generated moments earlier can rescue you here — a good reminder to save backup codes before clicking the final confirmation button, not after.

Recovery email addresses are 2FA too. Many services, Google included, treat your recovery email as a fallback authentication method. If that recovery email is a throwaway you no longer control, it's a liability. Update any that have gone stale.

Where You'll Likely End Up

Plan for roughly half a day, start to finish — the audit usually runs long. By the end, the realistic outcome is that most active accounts have TOTP-based 2FA, a few have SMS-only 2FA (better than nothing, weaker than TOTP), and a handful have no 2FA available. Those last ones are worth noting so you can reassess if a better option appears or you decide the account is worth abandoning.

The thing that surprises most people isn't the technical work, which is genuinely straightforward. It's discovering how much account hygiene decays silently. Old phone numbers. Recovery emails no longer checked. Backup codes generated and forgotten. None of it is visible until you go looking.

The payoff is real: even if someone has your password — through a breach, through phishing, through whatever — they can't get in without a device that's physically in your hand. For most realistic attack scenarios, that's enough. It isn't a perfect system, but it's a dramatically better one than a password alone, and it was never more than an afternoon away.

Start with email. Do that one today if you do nothing else. Everything else can follow at your own pace. But do start.