2FA with TOTP: how to turn it on in Gmail, Instagram and WhatsApp

More than 23 billion credentials are circulating on cybercriminal forums today. Most of them belong to users with a reasonable password — but with no additional layer of protection. If the server of a service you use gets compromised, or if your password turns up in a credential stuffing attack, a password alone doesn't keep your account safe. That's exactly what 2FA exists for — and specifically TOTP.

What TOTP is and how it works

What is TOTP, exactly?

TOTP (Time-based One-Time Password) is an authentication method that generates a 6-digit code every 30 seconds, calculated locally on your phone from a secret key — with no need for internet or SMS. The algorithm (RFC 6238) uses HMAC-SHA1, combining that key with the current timestamp. Because the server and the app start from the same key and the same clock, they arrive at the same code — and any generated code is valid for a single 30-second window.

In practice the flow is simple: you type your password as usual, the site asks for the 6-digit code shown in the app, you type it in and you're through. An attacker who stole your password can't get in without physically having your phone — or intercepting the code in real time, which is far harder than reusing a leaked credential.

Why you shouldn't use SMS as your second factor

An SMS code is still better than nothing, but it has three documented weaknesses. The first is the SIM swap scam: criminals convince the carrier to transfer your number to a SIM of theirs, and start receiving all your text messages — including verification codes. The second is SS7, a 1970s telecom protocol that still underpins voice and SMS networks and has known vulnerabilities allowing messages to be intercepted in transit. The third is real-time phishing: a fake page asks for your password and the SMS code at the same time, relaying everything to the real site before the code expires.

TOTP eliminates all three: the code never travels over a public network, it's generated offline on the device, and the 30-second window makes real-time attacks much harder to pull off successfully.

Which authenticator app to use

The most common choice is Google Authenticator — simple and it works, but for a long time it had no backup. Today it syncs with your Google account, which means your tokens are stored on the company's servers.

For anyone who wants full control, Aegis Authenticator (Android, free, GPL v3, available at getaegis.app) is the best alternative. It lets you export the encrypted vault to a local file, set up automatic backup to any folder — including Nextcloud or a USB stick — and import tokens from other apps. No cloud sync by default.

On iOS, Raivo OTP offers similar functionality and is open source. iCloud Keychain has also supported TOTP natively since iOS 15, integrated with Safari's autofill — a practical option for anyone already inside the Apple ecosystem.

How to turn it on in Gmail (Google account)

1. Go to myaccount.google.com and click Security in the side menu.
2. Under "How you sign in to Google", click 2-Step Verification.
3. Select Authenticator app and follow the flow to scan the QR code with your app.
4. Confirm by entering the 6-digit code generated, and save the backup codes (see the section below).

Google may suggest using passkeys instead of TOTP. Passkeys are technically more secure — they remove the risk of password phishing entirely — but they depend on the device being set up correctly. For anyone who wants broad compatibility across devices, TOTP is still the more practical option today.

How to turn it on in Instagram

1. Open the app and go to Settings and privacy > Accounts Centre > Password and security.
2. Tap Two-factor authentication and select the account you want to protect.
3. Choose Authentication app and scan the QR code shown.
4. Enter the code generated by the app to confirm activation.

Instagram offers SMS as an alternative method. Keep an up-to-date phone number on the account for emergency recovery — but set the authenticator app as your primary method.

WhatsApp: two-step verification with a PIN

WhatsApp doesn't support TOTP. Its second factor is a 6-digit PIN that you define, requested periodically and whenever the app is reinstalled or the number activated on another device. It isn't the same protocol as Google Authenticator, but it effectively protects against cloning and unauthorised reactivation of your number.

To enable it: Settings > Account > Two-step verification > Turn on. Choose a PIN you can remember without writing it down on the phone itself, and register a valid recovery email — it's used to reset the PIN if you forget it.

Backup codes: the step nobody takes

What are 2FA backup codes for?

Backup codes are single-use passwords generated by the service when you enable 2FA, which replace the authenticator app if you lose access to your phone. Each code works exactly once.

When you enable TOTP, the service offers between 8 and 12 codes. Keep them printed or in a password manager such as Bitwarden — never only in the photo gallery or the notes app on the same phone the authenticator protects. If the device gets stolen, both factors fall together.

For Aegis users: export the vault regularly to somewhere off the phone. The export file is encrypted with a password you set at the time.

Which accounts to protect first

If you only have time to set up 2FA on three accounts today, prioritise: your main email (whoever gets into your email gets into everything that uses password recovery), your bank account (if the bank supports an authenticator beyond SMS), and social accounts with an audience — Instagram, YouTube, TikTok. To see which services support TOTP, the site 2fa.directory keeps an up-to-date directory with per-service instructions.

2FA with TOTP is one of the most effective measures in basic digital hygiene: you configure it once, it works offline in the background, and it substantially raises the cost of any attack — even if your password shows up in a leak tomorrow. If you still don't have a password manager, that's the natural next step: the post on how to use Bitwarden covers the setup from scratch.