Quick Links

Two-factor authentication provides an extra layer of security for your online accounts. Many online services are offering two-factor authentication, including Apple. However, Apple's two-factor authentication needs some explaining, since it exists in two slightly different forms.

Apple has had "two-step verification" for Apple IDs for awhile, but with the release of iOS 9 and OS X El Capitan, they introduced a new method of adding extra security to your Apple ID, which they call "two-factor authentication". It can be confusing trying to decipher the differences between these two methods. We’ll discuss the differences, why you should move to the new method if you can, and how to set up and use both methods.

Related: Secure Yourself by Using Two-Step Verification on These 16 Web Services

The Difference Between Apple's Two-Factor Authentication and Two-Step Verification

In 2013, Apple introduced two-step verification, which adds an extra verification step in addition to your Apple ID password. When setting up two-step verification, you register one or more trusted devices that can receive 4-digit verification codes. These codes are sent using either SMS or Find My iPhone, and you are required to provide at least one SMS-capable phone number. From then on, any time you sign in to the Apple ID website, sign into iCloud, or make a purchase in iTunes, iBooks, or the App Store from a new device, Apple will send you a 4-digit code within a push notification, SMS message, or phone call to one of your trusted devices. You'll then enter that code on the new device you're trying to use to verify your identity.

twostep

When you set up two-step verification, you are provided a Recovery Key you can use to gain access to your Apple account if you forgot your Apple ID password or you lost the trusted device or phone number associated with your Apple ID.

Apple’s new two-factor authentication, first released in 2015, is an improved security method built directly into iOS 9 and OS X El Capitan. You must have at least one device running iOS 9 or OS X El Capitan to use it. On the surface, it looks very similar to two-step verification: when you attempt to use your Apple account on a new device, you'll have to approve it from a trusted device using a 4-digit code.

Here's the difference: the old two-step verification simply displays a dialog box indicating someone requested the 4-digit code displayed on the dialog box. With the new two-factor authentication method, your trusted device must be running iOS 9 or OS X El Capitan, and it adds an extra step before presenting the verification code. A dialog box displays first, listing the approximate location (based on the IP address the device is currently using) of the request and a small map. This sign-in request must be approved before the verification code is presented. If you don’t recognize the location and you didn’t request the sign-in, you can block the request at this point.

An example of Apple's two-step authentication process.
An example of Apple's two-step authentication process.

That extra step provides a bit more security than the two-step verification, and the new method is also quicker and easier to set up. You can set it up directly on any iOS 9 or OS X El Capitan device. However, unlike two-step authentication, you won't be provided with a Recovery Key in case you forget your password. But, you can regain access to your Apple ID with account recovery.

NOTE: You may also see mentions online about app-specific passwords being removed from two-factor authentication. However, when I logged into my Apple ID after setting up two-factor authentication (not two-step verification), and clicked “Edit” in the Security section, I saw a section where I can set up app-specific passwords.

How to Set Up Two-Factor Authentication for Your Apple ID

If you’ve been using two-step verification on your Apple ID up to this point, you need to turn it off before setting up two-factor authentication. To do that, sign in to your Apple account on the Apple ID website. In the Security section, click the “Edit” link on the right. Then, click “Turn Off Two-Step Verification”. You will be asked to create new security questions and to verify your date of birth. Once this is complete, you’ll get an email confirming that two-step verification has been turned off for your Apple account.

clicking_edit_to_turn_off_two_step_verification

You can turn on two-factor authentication on any device running at least iOS 9 or OS X El Capitan. We’re going to use an iPhone in our example. However, if you’re using a Mac running OS X El Capitan, go to System Preferences > iCloud > Account Details. Then, click “Security” and click “Turn on Two-Factor Authentication”. Then, follow the on-screen instructions.

On an iOS device, tap the “Settings” icon on the Home screen.

01_tapping_settings

On the Settings screen, tap “iCloud”.

02_tapping_icloud

Tap on your account name at the top of the iCloud screen.

03_tapping_account_name

If you’ve changed your password, your security questions (which you have to change to turn off two-step verification), or other information in your account, you’ll probably be asked to sign into your iCloud account again. Enter your password and tap “OK”.

04_sign_in_to_icloud

Tap “Password & Security” on the Apple ID screen.

05_tapping_password_and_security

On the Password & Security screen, tap “Set Up Two-Factor Authentication”.

06_tapping_set_up_two_factor_authentication

Tap “Continue” on the Two-Factor Authentication screen.

07_tapping_continue

If you have any devices still associated with your Apple ID that are not running at least iOS 9 or OS X El Capitan, you’ll see the following dialog box. You can still use an old device as long as you add a six-digit verification code to the end of your password any time you log in to that device. Tap “Turn On Anyway” to continue.

08_some_devices_not_ready

We want to take a moment to emphasize the text in the "Some of your devices are not ready" box because it will save you from a huge headache later. On your pre-iOS 9 devices you will need to tack your authentication number right onto your password. This means if your password is "Apple" and the authentication number they send you is "123456" then you verify your pre-iOS 9 devices by entering the two together as "Apple123456"--there is no separate box for your authentication number.

On the Phone Number screen, make sure the “Number” field contains a phone number that can be used to verify your identity. Under Verify Using, tap either “Text Message” or “Phone Call” to select the method by which you want to receive verification codes on non-iOS devices (if your phone number isn't attached to an iOS device). Then, click “Next”.

09_phone_number

You are returned to the Password & Security screen and Two-Factor Authentication should read “On”. You will also receive an email telling you that your Apple ID is now protected by two-factor authentication.

10_two_factor_authentication_on

Now, the next time you log in to a device that isn’t yet a trusted device, you will receive a notification on a trusted device that your Apple ID is being used to sign in to a device (such as an iPad) near an approximate location (based on the IP address of the device being signed into).

11_requested_sign_in_on_ipad

If you are the one signing into the device (even if you don’t recognize the location), tap “Allow” on the dialog box on the trusted device to continue logging in to the other device. However, if you do not recognize the location and you (or someone you know and trust) are not the one signing in, tap “Don’t Allow” to prevent anyone else from signing into the other device.

Once you allow the sign in, a verification code displays on the trusted device. You will use this to complete the sign in the other device.

12_verification_code_on_iphone

For example, I changed my password and my security questions on my Apple account. So, I have to log in to the iTunes Store again on my iPad. On the sign in dialog box, I enter my new password and tap “OK”.

13_sign_in_to_itunes_store

Then, I am asked for the six-digit verification code I received on my trusted device. I enter the code and I can now purchase and download apps and content from the iTunes Store. Remember, if you're signing into a device running an older version of iOS than iOS 9, you need to enter your password and code together in the same password box--e.g. password "Apple" and code "123456" become "Apple123456".

Once you’ve signed in to a device using a verification code, you won’t be asked for a code again on that device unless you sign out of your Apple account completely, erase the device and set it up as a new device, or need to change your password for security reasons.

14_enter_verification_code_for_itunes_on_ipad

You'll go through a similar process the first time you sign into your iCloud account from a new browser.

How to Set Up Two-Step Verification for Your Apple ID

If you don't have any devices running iOS 9 or OS X El Capitan but you want to protect the iOS devices you do have with extra security, you can set up the old two-step verification method. It's still available and will be for the foreseeable future (as of the publication of this article). Even though it’s not quite as secure as the new two-factor authentication method, it’s still a very important piece of added security that you should have.

To set up two-step verification for your Apple ID, open your favorite browser, go to https://appleid.apple.com, and log in to your Apple account. In the Security section, click the “Get Started” link.

01_clicking_get_started

A dialog box displays asking you to answer two of the security questions you set up for your account. If you don’t remember your answers, click the “Reset your security questions” link. Otherwise, enter your answers and click the “Continue” link that becomes available.

02_answer_security_questions

If you reset your security questions, you must wait before you can enable two-step verification. You’ll receive an email at all the email addresses associated with your account telling you the date and time after which you can set up two-step verification.

03_you_must_wait

You’ll also see a message in the Security section of your Apple account.

04_come_back_message

Once you’re able to set up two-step verification, log in to your Apple account and click “Get Started” in the Security section. The following screen displays. Click “Continue”.

05_getting_started_screen

On the “Add a trusted phone number” screen, enter the phone number you want to use to get a verification code each time you sign in to your account. Then, click “Continue”.

06_add_trusted_phone_number

You’ll receive a verification code in a text message at the phone number you specified. Enter that code on the Verify Phone Number screen and click “Verify”.

07_verify_phone_number

Related: How to Track, Disable, and Wipe a Lost iPhone, iPad, or Mac

Now, you can set up and verify any iOS devices you want to use as trusted devices. Trusted devices are any iOS devices on which you can receive verification codes when you sign into your Apple account. Any iOS devices you want to use as trusted devices must have Find My iPhone set up on them. So, if you don’t see the device you want to use on the list, you’ll need to set up Find My iPhone on that device. Once you’ve set up Find My iPhone on your trusted devices, click “Refresh Devices” so you see the devices in the list.

08_verify_trusted_devices

To verify a trusted device, click the “Verify” link to the right of that device’s name.

09_clicking_verify_for_ipad

A Verification Code displays on your device. Enter that code in the browser, just like you did for your trusted phone number. Tap “OK” on the Verification Code dialog box on your device to close it.

09a_verification_code_on_ipad

Verify each device you want to use as a trusted device in the same way, then click “Continue”.

10_clicking_continue_on_verify_trusted_devices

Your Recovery Key displays. You’ll need this key to be able to log into your Apple account if you ever forget your password or lose your trusted devices. Store your Recovery Key somewhere secure, such as in a password manager, and then click “Continue”. If you can't log in to your Apple account and you don't have your trusted devices, you will have to create a new Apple ID and forego the old one. Apple takes security very seriously, so, be sure you keep your Recovery Key safe.

11_recovery_key

Enter your Recovery Key on the Confirm Recovery Key screen and click “Confirm”.

12_confirm_recovery_key

You’re almost done. On the Enable Two-Step Verification screen, check the “I understand the conditions above” check box and then click “Enable Two-Step Verification”.

13_enable_two_step_verification

Two-step verification is now enabled. Click “Done”.

14_two_step_verification_enabled

Note that you might not see your trusted devices in the Security section immediately.

15_no_devices_available

Refresh the web page and you should see the devices you set up as trusted devices.

16_trusted_devices

In the Devices section, you can get information about each trusted device by clicking on the link for the device.

17_clicking_loris_iphone

The model, version, serial number, and the IMEI (International Mobile Station Equipment Identity) displays. If you no longer want this device to be a trusted device (maybe you don’t have the device anymore), click the “Remove” link (“Remove iPhone” in our example below).

18_clicking_remove_iphone

Now that two-step verification is enabled, the next time you sign into iCloud, or other Apple services, you’ll have to verify your identity.

19_sign_in_to_icloud

For example, when I log into my iCloud account, a popup dialog box displays asking me to verify my identity, so I click “Verify”.

20_verify_identity_for_icloud

Then, I choose a trusted device to which a verification code will be sent. If you’re using a computer you can trust (that no one else has access to), and you often use this browser, you can turn on the “Remember This Browser” option so you won’t be asked to verify your identity the next time you log in. Then, I click “Next”.

21_verify_your_identity

The Verify Your Identity screen displays. I want to use my iPhone to receive the verification code, so I click on “Lori’s iPhone” in the list.

22_signing_in_to_manage_your_account_again

I receive a verification code on my iPhone and enter that code on the Enter Verification Code screen. I don’t need to press Enter, because the code is checked automatically once I’ve entered it. If the code I entered is valid, I will have full access to my iCloud account.

23_enter_verification_code

If you need to sign in to your account using any apps that don’t natively support two-step verification, you can generate app-specific passwords for those apps.


We recommend you use the two-factor authentication method if your devices meet the minimum requirements. However, if you can't use that method, two-step verification is a viable option. Either method will provide the extra security your Apple account should have.