How to Set Up Passkeys and Two-Factor Authentication on Google, Microsoft and Apple Accounts: A Step-by-Step Guide

Your email, cloud storage, photos, documents and purchase history probably all sit behind three accounts: Google, Microsoft and Apple. If an attacker takes over one of them, they can reset passwords on many of your other services, because the password-reset email lands in the very inbox they now control. That is why the security of these three accounts matters more than any other single setting you own.

Fortunately, all three providers offer two powerful protections: two-factor authentication (2FA) and passkeys. Together, they make account takeover dramatically harder, and passkeys in particular are designed to resist even the phishing attacks that defeat older second factors. This guide walks you through setting both up on Google, Microsoft and Apple accounts, step by step, then covers what to do if you lose your device or get locked out. You will also find a setup checklist and answers to the questions readers ask most often.

Passkeys vs two-factor authentication: what is the difference?

Two-factor authentication means signing in with two things: something you know (your password) plus something you have or are (a code from an app, a text message, a tap on your phone). Even if someone steals your password, they cannot get in without that second factor.

A passkey goes further. Passkeys are FIDO cryptographic credentials tied to your account and stored on your device. Instead of typing a password and then a code, you sign in with your fingerprint, face or device PIN. Because the private key never leaves your device and the sign-in is bound to the real website, passkeys are phishing-resistant: a fake login page cannot trick a passkey into working. Your passkeys can also sync between your devices with end-to-end encryption, so they survive a broken phone.

The practical approach is simple: set up two-factor authentication everywhere first — it is the safety net — then add passkeys as the stronger, more convenient way to sign in day to day. The sections below do exactly that, provider by provider.

Before you begin

• Update your phone and computer to a recent operating system; passkeys need reasonably modern software.
• Make sure you can currently sign in to each account, and that you know your passwords.
• Keep your phone nearby — you will use it to approve sign-ins and receive codes.
• Set aside about fifteen minutes per account. Do not rush the recovery steps: they are the part that saves you later.

Google: 2-Step Verification and passkeys

Step 1 — Turn on 2-Step Verification

1. Go to your Google Account and open the Security section.
2. Find 2-Step Verification and select Get started, then sign in again if asked. Google’s official setup instructions walk through the same screens.
3. Follow the prompts to add a second step. Google will suggest the most secure available option first, such as a passkey or a prompt on your phone.
4. Add a backup second step as well — for example, authenticator app codes — so you are not stranded if one method is unavailable.
5. Confirm the setup and stay signed in on your trusted devices.

Step 2 — Create a passkey for your Google Account

1. In your Google Account’s Security section, look for the Passkeys option.
2. Choose to create a passkey and verify it is you — typically with your fingerprint, face scan or device PIN.
3. The passkey is saved to your device’s password manager and can sync to your other devices.
4. Next time you sign in to Google, you can choose the passkey instead of typing your password.

Passkeys are spreading beyond the big three accounts: for example, WhatsApp has added passkey support, which shows how quickly this is becoming the normal way to sign in.

Step 3 — Set up your recovery options

Recovery options are how Google confirms it is really you if your second factor is lost:

• Backup codes: during 2-Step Verification setup you can generate a set of one-time backup codes. Print them or save them somewhere safe — not in the same inbox they protect.
• Recovery email and phone: in the Security section, add a recovery email address and a recovery phone number you actually control, and keep them up to date when they change.
• If you are ever locked out, Google’s account recovery page will walk you through verifying your identity using these details. Answer from a familiar device and location where possible.

Microsoft: two-step verification and passwordless sign-in

Step 1 — Turn on two-step verification

1. Go to account.microsoft.com/security and sign in.
2. Select Manage how I sign in.
3. Under Additional security, find the Two-step verification section and choose Turn on, then follow the on-screen instructions. Microsoft’s official guide describes the same path.
4. Prefer the Microsoft Authenticator app over text messages where you can: Microsoft is phasing out SMS as a verification method, and app-based codes resist SIM-swapping far better. Our SIM-swapping and MFA defence guide explains why this matters.

Step 2 — Set up the Authenticator app

1. Install the Microsoft Authenticator app on your phone.
2. In your account’s security settings, add the app as a verification method and scan the QR code shown on screen.
3. Approve the test notification on your phone to confirm it works.
4. Turn on backup in the app’s settings so your verification methods can be restored on a new phone.

Step 3 — Go passwordless with a passkey

Microsoft’s support pages describe a passwordless option in the same security settings. Look for the passkey or passwordless sign-in option, create it on your phone or security key, and verify with your fingerprint, face or PIN. From then on you can sign in without typing a password at all.

Step 4 — Check your recovery information

In the same Security area, review the email addresses and phone numbers listed under your security info. Remove old ones you no longer control and add current ones. If you are locked out, Microsoft’s sign-in helper uses exactly these details to verify your identity, so stale information is the most common reason recovery fails.

Apple: two-factor authentication and passkeys

Step 1 — Turn on two-factor authentication

1. On your iPhone or iPad, open Settings, tap your name at the top, then tap Sign-In & Security.
2. Tap Turn On Two-Factor Authentication and follow the prompts, verifying a trusted phone number. These are Apple’s official steps.
3. If you do not have an Apple device handy, you can do the same on the web: sign in at account.apple.com and choose Upgrade Account Security.
4. Once enabled, signing in on a new device will ask for both your password and a six-digit code shown on your trusted devices.

Step 2 — Use passkeys with iCloud Keychain

1. Make sure iCloud Keychain and two-factor authentication are switched on — passkeys need both.
2. When a website or app offers to save a passkey, confirm with Face ID or Touch ID. The passkey is stored encrypted in iCloud Keychain and appears in the Passwords app, as Apple’s passkey guide for iPhone explains.
3. Because the passkeys sync through iCloud, they are available on your other Apple devices signed in to the same Apple Account.
4. To sign in on a device that does not have your passkey, the site can show a QR code: scan it with your iPhone and approve with Face ID or Touch ID.

Step 3 — Keep trusted devices and numbers current

Your trusted devices and trusted phone number are how Apple reaches you with verification codes. In Settings > [your name], review the device list and remove anything you sold or no longer own. Keep at least one trusted phone number you can actually receive messages on. If your number changes, update it before you need it — this single step prevents most lockouts.

What to do if you lose your device

Losing your phone is stressful, but if you completed the setup above you have several routes back in. Work through them in order:

1. Use another signed-in device. A tablet, computer or second phone where you are still signed in can approve the sign-in or show verification codes. This resolves most situations immediately.
2. Use your backup codes. For Google, the printed backup codes from 2-Step Verification setup get you in without your phone.
3. Restore the authenticator app. If you enabled cloud backup in Microsoft Authenticator (or your chosen authenticator app), install it on the replacement phone and restore.
4. Use synced passkeys. Passkeys that synced through your platform’s cloud keychain (Google Password Manager, iCloud Keychain) appear on your new device once you sign in to the platform account.
5. Fall back to recovery email or phone. Each provider lets you verify your identity through the recovery contact details you registered. Keep those details current — it is the cheapest insurance you own.
6. Start formal account recovery as a last resort. This is slower and deliberately strict, as described in the next section.

After you are back in, remove the lost device from your trusted devices, review recent sign-in activity for anything unfamiliar, and create fresh passkeys on the replacement device.

Locked out? How account recovery works

Account recovery exists for exactly this situation, but it is designed to be hard for attackers — which means it can be slow for you too.

• Google: the account recovery flow asks questions only the real owner should be able to answer and may ask you to wait while the request is reviewed. Using a device and location you have signed in from before, and providing the recovery email or phone number on the account, gives you the best chance. Be patient and do not submit multiple overlapping requests.
• Microsoft: the sign-in helper verifies you through your registered security info — alternate email addresses and phone numbers. If those are out of date, recovery becomes much harder, which is why the setup section above stresses keeping them current.
• Apple: if you cannot receive verification codes on any trusted device or phone number, Apple’s account recovery process verifies your identity and can take several days by design. Starting it from a familiar device helps.

During any recovery process, be wary of unsolicited calls or messages claiming to be support and asking for your codes. Real support staff will not ask for your password or verification codes — and scammers increasingly impersonate them, as our Google support phishing guide documents. If you have ever wondered whether your details were already exposed, our step-by-step breach-checking guide shows how to find out.

Your passkeys and 2FA checklist

• ☐ Two-factor authentication is on for my Google Account, with a backup second step added
• ☐ Two-factor authentication is on for my Microsoft account, using the Authenticator app rather than SMS
• ☐ Two-factor authentication is on for my Apple Account, with a current trusted phone number
• ☐ I have created passkeys for Google, Microsoft and Apple sign-ins
• ☐ My Google backup codes are printed or stored somewhere safe (not in my inbox)
• ☐ My recovery email addresses and phone numbers are current on all three accounts
• ☐ Authenticator app backup is switched on
• ☐ Old phones, sold devices and unknown sessions have been removed from trusted devices
• ☐ My devices run recent software that supports passkeys
• ☐ Someone I trust knows where my backup codes are, in case of emergency

Frequently asked questions

Are passkeys really better than two-factor authentication?

They solve different parts of the problem, and together they are stronger than either alone. Two-factor authentication protects your password; passkeys replace the password with something that cannot be phished or guessed. The FIDO Alliance, which develops the underlying standards, describes passkeys as phishing-resistant credentials bound to the legitimate site — a fake login page simply cannot use them. Keep 2FA enabled as your safety net even after you add passkeys.

What happens to my passkeys if my phone breaks?

If your passkeys sync through your platform’s cloud keychain — Google Password Manager or iCloud Keychain — they are restored when you sign in to the platform account on a replacement device. This is why the setup steps above emphasise sync and backup options rather than passkeys stored on one device only.

Do I still need my passwords after setting up passkeys?

For now, yes. Passkeys handle day-to-day sign-ins, but passwords remain as a fallback for recovery situations and for services that do not support passkeys yet. Keep them long and unique, and store them in a password manager rather than your memory.

Is SMS two-factor authentication good enough?

It is far better than nothing, but it is the weakest common second factor: attackers can intercept codes through SIM-swapping or phishing. Prefer authenticator apps, device prompts or passkeys. If SMS is your only option on some service, still enable it — then see our SIM-swapping defence guide to reduce the risk.

Can someone phish my passkey?

Not in the way passwords are phished. A passkey only works on the genuine site it was created for, so a convincing fake page cannot capture anything useful. You should still be cautious: attackers may try to trick you into approving a sign-in you did not start, or into handing over recovery codes.

I lost my phone and my backup codes. Am I locked out forever?

Not necessarily, but recovery will be slow. Each provider has a formal account-recovery process that verifies your identity through other means — recovery contacts, previously used devices and locations, and sometimes a waiting period. Start it as soon as possible and follow the instructions exactly. Then set up fresh recovery options the moment you are back in.

Should I use the same passkey for every site?

You do not need to think about this at all: a passkey is created per account, per site or app, automatically. Unlike passwords, there is nothing to reuse — each one is a unique cryptographic credential.

How often should I review these settings?

Once a year is a sensible rhythm, plus immediately after any big change: a new phone, a new number, selling a device, or any sign of suspicious activity. A five-minute review of trusted devices and recovery contacts prevents the vast majority of lockouts.

Sources and further reading

• FIDO Alliance: Passkeys — how passkeys work and why they resist phishing.
• Google Account Help: Turn on 2-Step Verification — official setup steps for Google’s second factor.
• Microsoft Support: How to use two-step verification with your Microsoft account — setup and management, including passwordless options.
• Microsoft account security settings — manage sign-in methods and security info.
• Apple Support: Two-factor authentication for Apple Account — official setup steps.
• Apple Support: Use passkeys on iPhone — passkey requirements and sign-in, including the QR-code flow.

By Uday Patil, Cybersecurity Analyst. Last reviewed October 2026. Menus and button names change over time; if a label differs slightly from what is described here, look for the closest equivalent in your account’s security settings.