Two-factor authentication means someone needs your password *and* a code from your phone to get into the account holding your photos — turning it on is one of the few things that genuinely stops most account takeovers.
What you need
- The account your photo backup lives in (Google, Apple, or similar)
- Your phone, to receive codes or approve sign-ins
- A few spare minutes to set it up and save backup codes
What this protects and what it doesn’t
This protects the account itself, not the photos directly — but since losing control of the account is one of the more common ways people lose access to their whole photo library, it’s a genuinely high-value five minutes.
How to turn on two-factor authentication
- Find the security settings for your account. For a Google account, go to myaccount.google.com and open Security. For Apple, go to Settings, tap your name, then Sign-In & Security.
- Turn on two-factor authentication (also called two-step verification). Follow the prompts to enable it. You’ll usually be asked to confirm a phone number or set up an authenticator app.
- Choose how you’ll receive codes. A text message is the simplest option; an authenticator app or physical security key is stronger if you want to go further, since text messages can occasionally be intercepted.
- Save the backup codes somewhere safe. Most services give you a set of one-off backup codes for when you don’t have your phone. Write these down or store them somewhere other than the phone itself, like a password manager or a printed copy.
- Test it by signing out and back in. Sign out of the account on one device and sign back in, to confirm you’re actually asked for the second step and that it works.
Check it’s asking for the second step
When you sign in again, you should be prompted for a code or an approval on your phone, not just your password. If that prompt appears and you can get past it, two-factor authentication is active.
If you lose access to your second factor
If you don’t receive codes, check the phone number or authenticator app is still current, and use a saved backup code to get in while you fix it. If you’ve lost both your phone and your backup codes, each provider has a separate, slower account-recovery process for exactly this situation.
Next step
Once the account itself is locked down, it’s also worth setting a recovery contact in case you’re ever locked out anyway — see Set a recovery contact for the account holding your only photo backup.
Sources and date checked
Based on Google’s and Apple’s own published account-security documentation, not a hands-on test performed for this article. Checked 22 September 2026.