← Back to Passwords & Account Access
Digital security
How to Set Up MFA and Back It Up
Some links on this site may earn us a commission, at no cost to you. It never decides what we recommend. How we make money.
Multi-factor authentication (MFA) is the second thing a site asks for after your password, usually a code. It stops most account takeovers that start with a stolen password. The catch is that people set it up, lose their phone and get locked out. Set it up properly once, with backups, and losing your phone is far less likely to lock you out.
This is one part of our passwords and account access guide.
Pick the strongest option each site offers
From strongest to weakest:
- Security key or passkey, where the site supports it.
- Authenticator app codes (one time codes that change every 30 seconds or so).
- SMS or email codes.
- Nothing.
Use MFA on every account that allows it. If SMS or email is the only option, use it anyway. It’s better than nothing.
Use an authenticator app instead of SMS or email
Prefer authenticator app codes over SMS or email. A code sent by text depends on your phone number, which can be moved to someone else’s SIM. An app code lives on your device.
Google Authenticator is a free option that can export your accounts as a QR code and sync them to your Google account. The sync is convenient, but it isn’t end-to-end encrypted, so anyone who gets into that Google account can reach your codes. If you use it, lock that account down with a long, unique password and a hardware security key.
What good looks like: an authenticator app that lets you back up or export your seeds.
Back up every seed when you set it up
When you add an account to an authenticator app, the site shows you a QR code and usually a text seed code. That seed is what generates your codes. Save it before you finish setup:
- Write down the seed code, or print the QR code.
- Some authenticator apps can export all your seeds as QR codes. Print them and store them offline.
- Save the site’s recovery codes too, if it offers them.
If your phone dies, you can restore every account from those backups on a new device.
Treat these backups like cash. Anyone who finds a printed QR code or seed can generate your codes. Don’t leave a copy as a file or screenshot on your computer or phone, in cloud storage, in email or in a notes app, because those copies get synced and backed up. If you have to create a file to print, delete it afterward and empty the trash. Print on a printer you trust, not a shared or public one, and shred any misprints.
Add security keys to the accounts that matter most
A hardware security key is the strongest second factor most sites support. Use one for your email, your password manager and your financial accounts.
Buy two and register both on each account, so you have a spare. Keep the spare somewhere safe, away from the first.
Our pick
YubiKey 5C NFC· Yubico
Yubico is the best known name in hardware security keys. This one connects by USB-C or a tap over NFC, so it works with newer phones and laptops. It stores up to 100 passkeys, needs no battery and is water and dust resistant.
Downside: You need two, one registered as a spare, so the cost doubles. It's USB-C, so if your computer only has USB-A, Yubico's YubiKey 5 NFC is the same key with a USB-A connector. If you can't spend that, an authenticator app is the next best thing.
What good looks like: a key that works with your phone and computer, and support on the sites you care about.
Use passkeys where they’re offered
A passkey replaces the password with a cryptographic key, so there’s nothing to type and nothing to phish. Many password managers, 1Password included, can store them. Use them where a site offers them, but keep your recovery options current in case you lose the device.
What good looks like: a manager or device that backs up your passkeys, and a recovery path you’ve actually tested.
Store the backups offline and offsite
Your MFA seeds, recovery codes and password manager recovery kit should live offline, not in a file on your computer.
- At home: a fire-rated safe is the obvious place.
- Somewhere else: keep a second copy at a different location, like a safe at a trusted friend’s or family member’s house. If your home burns down or gets broken into, the backup isn’t in the same place.
- Lock it up: anyone who finds these can use them, so keep them in a locked safe or box and don’t label them “MFA codes”.
- Format: printed QR codes or a USB drive both work for MFA backups.
What good looks like: an offline copy at home, and a second copy somewhere else you trust.
Start with your email
If you only set this up on one account today, make it your email. Most other accounts can be reset through it, so it’s the key to everything else. The main guide covers using a dedicated email for sensitive accounts.