Turn On Two-Step Verification for WhatsApp, Instagram and More

A password on its own is a single lock. If someone learns it, or tricks you into reading out a login code, they can walk straight in. Two-step verification adds a second lock that the other person does not have: a PIN only you know, a code from an app on your phone, or a text message sent to your number.

Every major social app offers it for free, and it takes only a few minutes per app. This guide walks through each one. Menu names change between versions, so treat the paths as a guide rather than exact labels. The settings belong to your account, so they apply whichever app you use to sign in.

WhatsApp: the six-digit PIN

WhatsApp does not use a password to sign in; it sends a code to your phone number. Two-step verification adds a PIN that must be entered whenever your number is registered on a new phone.

1. Open Settings → Account → Two-step verification.
2. Tap Turn on and choose a six-digit PIN that is not your birthday or a simple sequence.
3. Add an email address. It is optional, but it lets you reset the PIN if you forget it.
4. Confirm the email from the message WhatsApp sends.

WhatsApp will occasionally ask for the PIN to help you remember it. Never share it with anyone, including people who claim to be WhatsApp support.

Instagram: authenticator app first

Instagram manages security through Accounts Center.

1. Go to Profile → menu → Accounts Center → Password and security → Two-factor authentication.
2. Select the account you want to protect.
3. Choose Authentication app if you can. It works offline and cannot be redirected by someone who takes over your phone number.
4. Follow the prompts to link the app and enter the code it shows.
5. Open Additional methods → Backup codes and save them somewhere safe.

SMS or WhatsApp codes are still far better than nothing if you prefer not to install another app.

TikTok: at least two methods

TikTok asks you to pick more than one method so you have a fallback.

1. Open Profile → menu → Settings and privacy → Security.
2. Tap 2-step verification.
3. Select two or more of the offered methods, such as SMS, email or an authenticator app.
4. Tap Turn on and verify each method.

Keep the email address on your TikTok account current, because it is often the first step in account recovery.

Telegram: an extra password

Telegram signs you in with a code sent to the app or by SMS. Two-step verification adds a password on top.

1. Open Settings → Privacy and Security → Two-Step Verification.
2. Tap Set Password and choose a password you do not use elsewhere.
3. Add an optional hint that means nothing to anyone else.
4. Add a recovery email and confirm it with the code Telegram sends.

Without a recovery email, a forgotten Telegram password can be very difficult to recover, so do not skip that step.

Authenticator apps and backup codes

An authenticator app, such as Google Authenticator or Microsoft Authenticator, generates a new six-digit code every 30 seconds. The codes are created on your phone, so they never pass through the mobile network. A few habits make them work well:

• Turn on cloud backup inside the authenticator if it offers one, so a lost phone does not lock you out.
• Save backup codes from each service in a password manager or on paper kept at home. Do not store them as a screenshot in your gallery.
• Keep your recovery email secure with its own two-step verification, because it can reset everything else.
• Update your phone number in each app if you change SIM cards.

What two-step verification cannot do

It stops most attempts that rely on a stolen password, but it cannot protect a code you hand over yourself. Scammers often ask for "the code we just sent you". No real support team will ever ask for it. It also does not protect you from a harmful app already running on your phone, so keep installing from sources you trust.

Key takeaways

• Turn on two-step verification in every social app you use; each takes a few minutes.
• Prefer an authenticator app where it is offered, and use SMS as a fallback.
• Always add a recovery email and save backup codes somewhere other than your phone's gallery.
• Never share a PIN, password or login code with anyone, even if they claim to be support.