Two-factor authentication (2FA) is the reason a stolen Apple Account password is not enough for a stranger to get in. Most accounts already use it, but here is what it does and how to check.
What it is
Apple describes it as an extra layer of security designed to make sure you are the only person who can access your account, even if someone else knows your password. When you sign in on a new device or on the web, you need two things: your password and a six-digit verification code shown on your trusted devices or sent to your trusted phone number.
When you will see a code
After the first sign-in, that device is not asked again unless you sign out completely, erase the device, or need to change your password for security reasons. If you use end-to-end encrypted iCloud content, you may also be asked for a device passcode.
How to turn it on
On your device:
- Open Settings on iPhone or iPad, or System Settings on Mac.
- Choose your name, then Sign-In & Security.
- Turn on two-factor authentication and follow the prompts.
On the web: sign in at account.apple.com, then choose Upgrade Account Security.
Good to know
- If your account was created with 2FA, Apple says it cannot be removed. If you enabled it recently, you can lower security within two weeks.
- Apple Pay and Sign in with Apple require it.
- It also matters for recovery. Without it you cannot erase a device remotely from the Find My app. See what to do when you lose an iPhone.
Apple’s extra tips
Protect each device with a passcode (or a login password on Mac) and turn on Face ID, Touch ID or Optic ID if your device supports it.
Frequently asked questions
Where is the code sent?
To your trusted devices or your trusted phone number.
Is a password alone still enough?
For a first sign-in on a new device, no. You also need the code.
Sources
Last checked November 3, 2026. Apple changes its instructions between updates, so if a menu looks different on your Mac, check the linked Apple page.
