Short answer: Most services let you disable 2FA under the same security settings where you enabled it, after confirming your password and a current code. But before you do, ask what problem you are actually solving — because in most cases there is a better fix that keeps your protection intact. Switching methods, trusting your own device, or moving to a passkey usually beats turning it off.
The legitimate reasons
There are a handful of situations where disabling genuinely makes sense:
- You are switching methods and the service requires you to remove the old one first — moving from SMS to an authenticator app, for instance.
- You lost the device and, having recovered access with a backup code, need to re-enrol from scratch.
- An old integration genuinely cannot handle it and there is no app-password alternative.
- You are closing the account and want a clean exit.
- The account is genuinely worthless — a throwaway forum login with no personal data and no reused password.
Notice that four of the five are temporary states, not permanent decisions.
The reasons that are really a different problem
Most people who want to turn 2FA off are trying to solve one of these. Each has a better answer.
“It asks for a code constantly.” Tick “remember this device” on hardware only you use — see is skipping 2FA with trusted devices safe? Or better, move to a passkey, where signing in is one biometric tap.
“My codes keep getting rejected.” That is clock drift, not a reason to abandon 2FA. Turn on automatic network time — why 2FA codes get rejected.
“I’m changing phones.” Back up or transfer the tokens instead — how to back up your authenticator app and transferring Google Authenticator.
“I’m changing my number.” Update the number in each account first, and use the opportunity to move off SMS — changing your phone number and 2FA.
“I’m travelling and worried about signal.” Authenticator codes work offline in any country. It is SMS that breaks — 2FA while travelling.
“Someone else needs access.” Use proper delegated access or a shared password manager vault — 2FA for small teams.
Accounts where you should not turn it off
Bluntly: email, banking, payment platforms, cloud storage, password managers, domain registrars, crypto exchanges, and work systems.
Email is the strongest case. It is the reset path for everything else, so removing 2FA there quietly removes protection from every account that recovers through it. Whatever inconvenience prompted the thought, it is smaller than that.
Some services will not let you disable it at all — GitHub for code contributors, Shopify for certain roles, Apple Accounts created recently, Steam for trading. That is deliberate, and worth respecting rather than working around.
How to disable it safely, if you must
- Do it deliberately, not in a rush. Disabling while locked out and panicking is how people make things worse.
- Have the replacement ready. If you are switching methods, set up the new one in the same session so the gap is measured in seconds.
- Use a strong unique password. Once 2FA is off, the password is the entire defence. If it is reused anywhere, change it now — see password vs passphrase.
- Check it has not leaked — how to check.
- Turn on login alerts so an unfamiliar sign-in reaches you.
- Note the date and set yourself a reminder to re-enable it.
- Destroy old backup codes and, if you re-enable later, generate fresh ones — the old set is no longer valid anyway.
One more, easily missed: if you were sharing a TOTP secret with anyone, re-enrolling generates a new secret. The old one keeps producing valid codes until you do — which matters when someone leaves a team.
Where to find the setting
It is always in the same place you enabled it:
- Google — Security → 2-Step Verification → Turn off.
- Microsoft — Security → Advanced security options → Two-step verification → Turn off.
- Facebook / Instagram — Accounts Centre → Password and security → Two-factor authentication.
- Amazon — Login & Security → Two-Step Verification settings → Disable.
- X, LinkedIn, Reddit, Discord — the same security page used to enable it.
All of them require your password and usually a current code, which is why you must do this before losing access rather than after.
The better alternative in almost every case
If friction is the problem, passkeys solve it properly. Signing in becomes a fingerprint or face check — faster than typing a password, let alone a code — while remaining genuinely multi-factor and phishing-resistant.
People who move their main accounts to passkeys generally stop wanting to disable anything, because the thing they were objecting to has gone. See passkeys vs 2FA and what WebAuthn and FIDO2 are.
Frequently asked questions
Can I turn off 2FA without my phone?
Usually you need a current code or a backup code to confirm. Without either, it becomes an account recovery process with support. See recovering accounts after losing your 2FA phone.
Does disabling 2FA log me out everywhere?
Not usually, though some services end sessions as a precaution. Existing logins generally continue.
Will my old backup codes work if I re-enable later?
No. Re-enabling generates a new secret and a new set of codes. Discard the old ones and save the new set.
Is it safe to remove 2FA from an unimportant account?
Only if the password is unique to that account and there is nothing personal in it. If the password is reused anywhere, the account is not unimportant — see credential stuffing.
Some services won’t let me disable it. Why?
Because the account type carries elevated risk — code contributors, sellers, traders, admins. It is a deliberate policy, not a bug.
I keep locking myself out. Is 2FA just not for me?
It is a backup problem, not a 2FA problem. Enrol two devices, save the codes offline, and it stops happening. See the 9 most common 2FA mistakes.
The bottom line
Turning 2FA off is easy, reversible, and usually the wrong answer to whatever prompted it. Work out what is actually irritating you — repeated prompts, rejected codes, a new phone — and fix that instead. And if you genuinely must disable it, do it deliberately, with a strong unique password in place and a date in your calendar to switch it back on.
Looking for less friction rather than less security? Passkeys are almost certainly what you want.