Short answer: Apple’s two-factor authentication is built into the operating system, not an authenticator app. Turn it on at Settings → [your name] → Sign-In & Security → Two-Factor Authentication → Turn On on iPhone, or System Settings → [your name] → Sign-In & Security on Mac. Codes are delivered to your trusted Apple devices automatically. You cannot use Google Authenticator with an Apple Account — and you do not need to.
Apple does 2FA differently, and that confuses people
Most services hand you a QR code and let you choose your own authenticator. Apple does not. Its two-factor system uses your other Apple devices as the second factor: sign in somewhere new, and every Mac, iPad and iPhone signed into your account shows a map and a six-digit code.
That is a legitimate design, and in one respect a strong one — the code is generated and delivered inside Apple’s ecosystem rather than over SMS. But it means three things people regularly get wrong:
- There is no QR code to scan into an authenticator app. Searching for “Apple ID authenticator app setup” leads nowhere because the option does not exist.
- If you own exactly one Apple device and lose it, recovery is genuinely difficult. Set up the safety nets described below.
- Apple renamed “Apple ID” to “Apple Account” in 2024, so menu labels differ between older and newer guides. The settings path is the same.
If you are new to the concept generally, our complete guide to two-factor authentication covers the fundamentals.
Step 1: Turn on two-factor authentication
On iPhone or iPad:
- Open Settings and tap your name at the top.
- Tap Sign-In & Security.
- Tap Two-Factor Authentication, then Turn On.
- Confirm your trusted phone number and verify it.
On Mac: System Settings → [your name] → Sign-In & Security → Two-Factor Authentication → Turn On.
Accounts created in the last few years have this enabled by default and cannot switch it off — that is intentional. If your account is older and it is off, turning it on is the single highest-value security action available to you, because your Apple Account holds your photos, backups, iCloud Keychain passwords, and Find My.
Step 2: Add a second trusted phone number
Under Sign-In & Security → Two-Factor Authentication → Trusted Phone Numbers, add a second number — a partner’s phone, a family landline, a work line.
This is the cheapest insurance available. If your only trusted number is the phone you just dropped in the sea, you are relying on Apple’s account recovery process, which deliberately takes days. A second number turns that into a two-minute problem.
One caveat: a trusted phone number can receive verification codes by SMS, which means it inherits the risks of the phone network. Anyone whose number is worth hijacking should read our guide to SIM swap attacks and add a port-out PIN with their carrier.
Step 3: Generate a recovery key (and understand the trade-off)
Under Sign-In & Security → Recovery, you can create a 28-character Recovery Key. When one exists, Apple’s standard account recovery is disabled — the key becomes the only way back in.
That cuts both ways:
- Upside: nobody can social-engineer Apple support into resetting your account. This closes a real attack path.
- Downside: lose the key and your devices, and the account is gone permanently. Apple cannot help. There is no appeal.
Create one only if you will store it properly — printed and kept somewhere physical, or in an encrypted vault you can reach without your Apple devices. The same reasoning applies to any service’s recovery codes, which we cover in where to store 2FA backup codes safely.
Step 4: Add recovery contacts
Also under Recovery, you can nominate one or more Account Recovery Contacts — people who can generate a recovery code for you. They gain no access to your data; they can only help you prove you are you.
For most households this is a better safety net than a recovery key, because it fails gracefully. Pick someone who will still be reachable and still like you in five years.
Step 5: Turn on Stolen Device Protection
This is the setting that closes the most common real-world attack on iPhones, and most people have never enabled it.
The attack: a thief watches you type your passcode in a bar or on a train, then steals the phone. With the passcode they can change your Apple Account password, disable Find My, and lock you out of your own digital life within minutes. Two-factor authentication does not help, because the phone is the trusted device.
Stolen Device Protection (Settings → Face ID & Passcode → Stolen Device Protection) requires biometrics with no passcode fallback for sensitive actions, and imposes a one-hour security delay on the most damaging ones when you are away from a familiar location. Switch it on, and set the delay to “Away from Familiar Locations”.
Step 6: Review devices and app-specific passwords
Scroll to the bottom of your account settings to see every device signed in. Remove anything you no longer own — an old iPad you sold still counts as a trusted device that can display your verification codes.
Also check Sign-In & Security → App-Specific Passwords. These are passwords issued to third-party apps (older mail clients, for instance) that bypass two-factor authentication entirely. Revoke any you do not recognise.
Frequently asked questions
Can I use Google Authenticator or Authy with my Apple Account?
No. Apple does not support third-party TOTP authenticators for signing into your Apple Account. Codes come from your trusted devices or trusted phone numbers only. You can, of course, use those apps for every other service — see the best authenticator apps.
What if I only own one Apple device and lose it?
You will need a trusted phone number, a recovery key, or a recovery contact — which is exactly why steps 2 to 4 matter. Without any of them, Apple’s account recovery can take several days. Our guide on recovering accounts after losing a 2FA phone covers the general process.
Can I turn Apple’s two-factor authentication off?
If your account is recent, no — it is permanent. Some older accounts can disable it within two weeks of enabling it, after which it becomes permanent. This is one of the few cases where being unable to weaken your own security is a feature.
Where do I find my verification code?
It appears automatically on your trusted devices. If you are away from them, tap Didn’t get a verification code? on the sign-in screen and choose to receive it by text or call, or generate one on a trusted iPhone at Settings → [your name] → Sign-In & Security → Get Verification Code.
Is Apple’s two-factor authentication as strong as an authenticator app?
Broadly comparable and in some ways better, because delivery to trusted devices is not exposed to the phone network the way SMS is — see SMS vs authenticator apps. Its weakness is the passcode-based device path, which Stolen Device Protection addresses. Neither approach is phishing-resistant in the way a hardware security key is; Apple now supports security keys for Apple Account sign-in if you want that level.
Does this protect my iCloud data if someone gets my password?
Two-factor blocks the sign-in. For the data itself, also consider turning on Advanced Data Protection, which end-to-end encrypts most iCloud categories — including backups. Note it requires a recovery key or recovery contact, so do steps 3 and 4 first.
The bottom line
Apple’s 2FA is on by default for most people, which makes it feel like there is nothing to do. There is: add a second trusted phone number, nominate a recovery contact, turn on Stolen Device Protection, and clear out devices you no longer own. Those four take ten minutes and cover the failure modes that actually lock people out of their Apple Accounts.
For everything outside Apple’s ecosystem, an authenticator app is still the tool — see how TOTP codes work or generate one now with our free online 2FA code generator.