How to set up 2FA on a crypto exchange, step by step

To set up 2FA on a crypto exchange, install an authenticator app (or create a passkey), open the exchange’s security settings, scan the QR code, enter the six-digit code and save your backup codes somewhere offline. The whole process takes about five minutes, and it is the single most effective step against account takeover.

The steps below work on any exchange, though menu names differ. Two-factor authentication protects your login, not your investment: crypto prices are volatile and you can lose all the money you put in.

What is two-factor authentication?

Two-factor authentication (2FA) means your exchange asks for two separate proofs before you can sign in or withdraw: your password plus a second factor, such as a code, a passkey or a security key. If someone steals your password, they still can’t gain access without that second factor.

The authentication factors fall into three groups: something you know (a password or passcode), something you have (your phone or a key) and something you are (a fingerprint or facial recognition). 2FA adds an extra layer by combining two of them. Our glossary entry on what 2FA is in crypto explains the idea in more depth.

2FA doesn’t stop every scam. If you type a code into a fake website, or read it out to a fake “support agent”, the attacker can use it within seconds. Read our guide to phishing before you rely on codes alone.

Authenticator app vs SMS vs passkeys: which method to choose

Choose a passkey or hardware security key if your exchange offers one, an authenticator app if it doesn’t, and SMS only as a last resort. The difference is how easily an attacker can steal or intercept the second factor.

Method	How it works	Main weakness	Our view
Passkey or security key	Your device proves who you are with a key tied to the real website	You need a backup key or a synced passkey	Strongest; resists phishing
Authenticator app	An app generates a new code every 30 seconds	A fake site can capture a code in real time	Good default
SMS code	The exchange texts a code to your phone number	SIM swaps and intercepted text messages	Weakest; avoid if you can

Passkeys and security keys

A passkey replaces the code with a cryptographic key stored on your phone, computer or a physical security key. You unlock it with your fingerprint, face or device PIN, and it only works on the website it was created for, so a lookalike phishing site gets nothing.

Authenticator apps

Authentication apps such as Google Authenticator or Microsoft Authenticator generate time-based codes from a secret key that the exchange shares with you once, during setup. The codes are created on your device, not sent over the network, which is what makes them stronger than SMS. Most apps for Android and Apple phones offer an encrypted backup, so you can move your codes to a new device.

SMS codes

SMS messages are the weakest method because they depend on your phone number, not your phone. In a SIM swap, a criminal convinces your mobile service provider to move your number to their SIM card and then receives your codes. If SMS is your only option, set a PIN on your mobile account and switch as soon as the exchange offers something better.

How to set up 2FA on a crypto exchange

Setting up 2FA follows the same process on almost every exchange: secure your email, install the app, link it with a QR code, confirm with a code and save your backups. Follow these steps with an authenticator app:

Test your 2FA before you need it

Log out, then sign in again with your username, password and a fresh code. If it works, also check which actions now ask for 2FA: on many exchanges withdrawals, new withdrawal addresses and API keys each need a code, and some have their own security checks. Note that many exchanges pause withdrawals for a short period after you change your 2FA, which is intended to stop an intruder.

Setting up a passkey instead

If your exchange supports passkeys, choose “passkey” or “security key” in the same 2FA menu. Your phone or computer asks for your fingerprint, face or PIN, then stores the passkey. Add a second passkey on another device, or a physical security key, so losing one device doesn’t lock you out.

Save backup codes and recovery codes

Backup codes, also called recovery codes, are one-time codes that let you sign in when you can’t use your phone. Each code works once, so cross it off after you use it.

• Save them the moment the exchange shows them; some exchanges show them only once.
• Print them or write them down, and keep them in a secure place, away from your phone.
• A password manager with its own strong password is a reasonable second copy. A screenshot in your camera roll is not.
• Never share them. Anyone with a backup code and your password can sign in as you.

If your exchange doesn’t offer backup codes, use your authenticator app’s encrypted backup, or add a second device or security key, as your alternative method.

What to do if you lose your phone

If you lose your phone or it is stolen, act in this order: protect the phone, sign in another way, then replace the lost device in your account settings. Do it quickly, before someone else tries.

Be careful with “recovery help”. Real exchange staff never ask for your password, your backup codes or your seed phrase, and they don’t contact you first on social media.

Common 2FA mistakes to avoid

Most 2FA problems come from a few habits. Each of these has locked people out or let attackers in:

• Keeping your authenticator app on the same phone that receives your SMS password resets, with no backup.
• Using SMS when an authenticator app or passkey is available.
• Skipping backup codes, or storing them in an unencrypted note.
• Typing codes into a page you reached from an email or ad.
• Deleting the authenticator app, or wiping a phone, before moving your codes to a new device.

Next steps for safer online accounts

2FA is one layer; add a few more for your crypto and other online accounts. These next steps take minutes:

• Use a password manager and a unique password for each exchange and for your email.
• Turn on a withdrawal allow-list and login alerts if your exchange has them.
• Check that your exchange is authorised under MiCA in your EU country; since 1 July 2026 only authorised providers may serve EU residents.
• Keep larger, long-term holdings in a wallet you control.

Our guide on how to keep your crypto safe covers phishing, SIM swaps and exchange hacks, and our list of exchanges with strong security compares licensed platforms.