Enable 2FA in iOS or iPadOS

To turn on 2FA on your iPhone or iPad, follow these steps:

1. Tap Settings > Account Name > Sign-In/Password & Security.

2. Tap Turn On Two-Factor Authentication (Figure 15).

3. Tap Continue.

4. Apple prompts you to provide a trusted phone number; it may pre-enter the phone number with an iPhone. (If you get a warning that the number is already in use, see the sidebar below.) You can opt to either receive an SMS (text) message, or an automated call, in which a code is spoken by an artificial voice.

5. Tap Next.

6. Enter the verification code that arrives via SMS or by voice.

Code-based two-factor authentication is now active.

Enable 2FA in macOS

The steps are quite similar in macOS, with one difference when it comes to the phone number:

1. Go to System Preferences > Apple ID > Password & Security (Monterey) or System Settings > Account Name > Sign-In/Password & Security (Ventura or later). You may be prompted to enter your password.

2. Click Turn on Two-Factor Authentication.

3. You must confirm that an already-provided phone number is accurate. As with iOS and iPadOS, you can opt to receive a code as an SMS or automated voice call.

4. Enter the verification code that arrives.

And, voilà! You’ve turned on code-based two-factor authentication.

Log In with Hardware 2FA

While I haven’t yet told you how to Deploy a Security Key with Apple ID, this is the right place in the sequence to tell you how to log in using one. The process is nearly identical in iOS, iPadOS, macOS, and the iCloud.com and Apple ID websites:

1. Go to any location where you can log in to Apple ID, such as in the Settings app in iOS/iPadOS or iCloud.com.

2. Enter your Apple ID username and password.

3. You’re prompted to activate the security key (Figure 16). Plug it in and tap or press it, depending on the device, or, for an NFC key, hold it nearby and activate it.

   

4. Your device or the Apple website recognizes the validity of the security exchange and logs you in.

5. With an Apple website, you’re given the option to trust the browser, obviating a 2FA login for a while (Figure 17).

Log In with Code-Based 2FA via iOS, iPadOS, or macOS

The process of logging in with 2FA using an Apple-provided code starts the same no matter where you begin: you enter your Apple ID (if it’s not already pre-filled for you) and the account’s password, and click or tap whatever button lets you proceed.

Next, all iOS, iPadOS, and macOS devices logged in to iCloud services with that Apple ID display a dialog showing your rough location (Figure 18). Click or tap Allow to proceed. That dialog disappears on all devices other than the one with which you just interacted.

This step resembles the app-based confirmation available with Dropbox, Google, and others, but it’s more like the appetizer before receiving the second factor. By providing this alert on all trusted devices, it helps disclose someone attempting to log in to your account before it proceeds further.

On the device you agreed to allow access to the account via iOS, iPadOS, or macOS, the operating system brings up a dialog with a six-digit code (Figure 19). Enter that code in the software, website, or device prompt to which you’re gaining access. With iCloud.com, you can also agree to trust the browser for 30 days.

Log In with Code-Based 2FA via the Web

Logging in to iCloud.com via a web browser using 2FA baffles many readers because the 2FA prompt to allow access and provide a code appears on the browser’s device (if it’s also logged in to the same iCloud account). Doesn’t that violate the separate-factors principle?

Not really! Because you’ve trusted the hardware device on which you’re logging in—whether a Mac, iPhone, or iPad—the trust lies in that device, and its physical nature. You know the password, but you still have to have the hardware. Starting at least by iOS 17/iPadOS 17, Apple provides a slightly more specific alert when a code is for a web login (Figure 20)—possibly earlier, but this is when I spotted it.

Apple updated iCloud.com logins a few years ago to support Touch ID within macOS. If you have 2FA enabled, you may be able use Touch ID for a login without being prompted for 2FA.

Log In with Code-Based 2FA by SMS or Voice Call

Sometimes you might be trying to log in to an Apple site or service and not have a trusted device for that Apple ID nearby. Or, as I explain in Set Up 2FA Codes Without a Device, you may have an Apple ID that you upgraded to 2FA but don’t have that account ever logged in to iCloud on a device you use.

In that case, Apple lets you choose a fallback path like this:

1. Enter your Apple ID and password at the site or service.

2. When prompted to enter the six-digit verification code, click or tap “Didn’t get a verification code.”

3. A dialog appears that should offer you choices that include Text Me (Figure 21). Click or tap that. (The message will vary depending on whether you have voice, text, or both available.)

   

4. If you have multiple trusted numbers for SMS codes or automated voice calls, you will be given a choice which shows just part of the number. If there’s just a single choice, Apple automatically texts you or calls you.

5. Enter the code. Messages offers to autofill the code in iOS/iPadOS and macOS.

Log In with a Passkey to Apple Websites

Starting with iOS 17/iPadOS 17 and Sonoma, you can bypass passwords and second factors when logging in to Apple websites using your Apple ID. For instance, visit appleid.apple.com, you’re typically prompted to validate a stored login with Touch ID or Face ID, and then receive either a 2FA code or use a security key.

However, in a browser you don’t have login information stored for—such as somebody else’s computer or under Android or Windows—a passkey is now a secure alternative. You can also reach the passkey login option to access an account other than the default one stored for biometric login via Touch ID or Face ID.

Here’s how to log in to your Apple ID account with a passkey:

1. Go to appleid.apple.com and click Login.

2. If you’re presented with a Touch ID or Face ID option, click “Use a different Apple ID.”

3. Enter any email address or phone number associated with your Apple ID and press Return.

4. Click “Sign in with Passkey” (Figure 22).

   

5. A Sign In dialog (or similar in other browsers and platforms) appears that shows a QR code and says you need to scan it (Figure 23). Use your iPhone or iPad to scan the code and tap “Sign in with a Passkey.”

   

6. On your iPhone or iPad, you’re asked to validate the sign in. You may be asked to tap Continue before your device accepts a Touch ID or Face ID approval.

You’re now logged in!

Log In with Code-Based 2FA from a Legacy Device

You may be using older hardware—or hardware you chose not to upgrade—that can’t support 2FA logins in the way that newer versions of the operating systems can. That includes systems running iOS 8 and older and macOS 10.10 Yosemite and older, as well as the 2nd and 3rd generation Apple TV models.

On those devices, Apple has a way to use the 2FA code that’s not immediately obvious:

1. Try to log in using your Apple ID and password.

2. The login attempt will not be successful, but this will trigger the 2FA sequence on any modern iOS, iPadOS, or macOS device associated with the Apple ID. Allow the login and view the code.

3. Back on your original device, re-enter the password and add, at the end, the six-digit code. Do not insert a space between the password and code.

The login should now be accepted.

To skip step 2, you can generate a 2FA code within iOS, iPadOS, or macOS. On an iPhone or iPad, go to Settings > Account Name > Sign-In/Password & Security and tap Get Verification Code.

In macOS, go to System Preferences > Apple ID > Password & Security (Monterey) or System Settings > Account Name > Sign-In/Password & Security (Ventura or later) and click Get (a) Verification Code.

Why Apple May Prompt You for a Passcode

In some circumstances, Apple may ask you to enter the passcode or passphrase for your iPhone or iPad as part of 2FA authentication on an iPhone, iPad, or Mac (Figure 24). That may seem completely wrong, right? Why would your mobile device’s access code have anything to do with logging in?

It comes from a proper level of privacy and security, not a lack of it. If you use iCloud Keychain, the People album in Photos, the Find My network, or some other services, Apple never knows the content of the data shared among your devices. Each of your devices shares a set of encryption keys that allow them to exchange information privately via iCloud without Apple having any way of decrypting it.

If you once set up one or more of these services among your iCloud-linked devices before enabling 2FA, you used a different process you may have forgotten that allowed them to exchange a shared secret via an iCloud Security Code.

For new devices after you enable 2FA, you have to share the secret. Apple claims that it might prompt you to enter an iCloud Security Code. That may be true! But I believe that’s only the case when you’ve received your 2FA code via a trusted device. If you use a trusted phone, Apple switches up the verification.

Instead of using the iCloud Security Code, it lets you unlock the private data only your devices can decrypt using the passcode of one of those devices (typically your iPhone).

Apple doesn’t retain or upload the passcode of the other device. Rather, it unlocks the secured data from the privately synced iCloud set, and generates a new encryption key for your newly added device, which is then synced among all the other devices is the set.

The company hasn’t documented this process at all, so I’m making a slight conjecture from observations. Not even a screen capture or the text that appears above is on Apple’s support or marketing sites.

Change or Add Trusted Devices

You can add a trusted device by using it to log in to your Apple ID account via iCloud. In iOS or iPadOS, go to Settings > Account Name. In macOS, go to System Preferences > Apple ID (Monterey) or System Settings > Account Name (Ventura or later). Similarly, to remove a trusted device from the set, log out of iCloud on that device.

Because 2FA maps one-to-one to a logged-in iCloud account, your set of associated iCloud devices and your set of 2FA trusted devices are always identical.

With iOS or iPadOS, that one-to-one relationship ties up the entire device. However, with macOS, each person with a macOS user account can log in using a different Apple ID in their respective account’s Apple ID preference pane. This can be helpful even if you don’t routinely log in to that macOS account, as it provides another trusted device as a backup in case something goes wrong and you lose access to other trusted devices or phone numbers.

Change or Add Trusted Phone Numbers

Apple requires that you have at least one trusted phone number connected to your Apple ID, although you can add more. As noted earlier, Apple seems to sometimes restrict you from associating the same phone number with multiple Apple IDs—some people can’t, yet I and others can.

This can put you in a conundrum. Suppose you have a phone number already used with a different Apple ID—say, you have a split between an iCloud account and a purchases account, like many long-time Apple ecosystem people do. You want to add that number as a backup for a different Apple ID, to improve your odds of recovering account access should something go wrong. If you’re one of the people who gets an “already in use” error, what to do? The easiest thing is to sign up for a free Google Voice number in a country in which it’s offered.

You can add or delete a trusted phone number on the Apple ID site (via Sign-In and Security > Account Security), in iOS or iPadOS (Settings > Account Name > Sign-In/Password & Security), and in macOS Monterey (System Preferences > Apple ID > Password & Security) or macOS Ventura or later (System Preferences > Account Name > Sign-In/Password & Security).

Enroll Your Apple ID via macOS

Here’s how to set up security keys for your Apple ID in macOS:

1. Go to System Settings > Account Name > Sign-In/Password & Security and click Add to the right of the Security Keys label (Figure 26).

   

2. Apple presents an overview of how security keys affect your account. Click Add Security Keys to continue.

3. You may be prompted to remove devices from your account that haven’t been online for 90 days or more. Click Remove Inactive Devices if that works for your needs.

4. If prompted to enter your account password, do so.

5. Apple warns you two keys are required; click Continue.

6. Even though the dialog says Apple ID and “Apple ID wants to make changes,” enter your macOS account’s password and click Allow.

7. To add each security key, you’re presenting with an Add the First Security Key or Second Security Key screen. Follow these steps for both passes:

   1. Click Continue.

   2. When prompted to Add Security Keys, insert the key and then activate it: press a button, put your fingers on two sides of it, or tap it, as the case may be (Figure 27).

   3. Name the key uniquely in macOS—perhaps write a number on it in indelible marker—and click Continue. By default, Apple fills in the key’s model name.

      

8. After enrolling both keys, Apple may provide a list of devices currently signed in to your iCloud account. You can select those to log out at this step, click Stay Signed In to All, or even click Cancel to end the process without enrollment. (If you only have a single device in your account, you won’t be prompted, naturally.)

9. At the acknowledgement screen, click Done.

Apple sends an email to your Apple ID-associated address to confirm enrollment (or alert you of that fact).

Enroll Your Apple ID via iOS/iPadOS

The process is nearly identical to using macOS. Two differences:

• Start at Settings > Account Name > Sign-In/Password & Security and tap Add Security Keys or Set Up next to the Security Keys label.

• When you’re prompted to add a key in step 5b above, you can bring an NFC-equipped security key near the top of your iPhone or iPad and it will be recognized and activated.

Change Security Keys

Apple doesn’t require a security key to be present to remove it or disable security key authentication, nor to add additional keys.

Go to Settings (iOS/iPadOS)/System Settings (macOS) > Account Name > Sign-In/Password & Security. Tap Two-Factor Authentication > Number next to the Security Keys label or click Edit next to the Security Keys label (Figure 28).

In iOS/iPadOS:

• Tap an entry and you can rename it, or tap Remove Key and confirm to remove it.

• Tap Remove All Keys and confirm by tapping Remove to disable authentication. Then enter your iPhone or iPad passcode.

• Tap Add Security Key to enroll additional keys. Apple prompts you for the device passcode. Enter it and tap Done.

In macOS:

• Click an entry’s name to change the name.

• Select an entry and click the minus icon to remove it and confirm its removal.

• Click Remove All Keys and enter your macOS account password.

• Click the plus icon to enroll additional keys. Apple prompts you for your Mac account password.

Reset a Password in iOS/iPadOS with Extra Authentication

Follow these steps to reset your Apple ID password in iOS or iPadOS with code-based 2FA or security keys enabled:

1. Go to Settings > Account Name > Sign-In/Password & Security.

2. Tap Change Password.

3. You’re next prompted for your iPhone or iPad passcode. (This isn’t a code transmitted by Apple. It’s the one you use to unlock your iPadOS or iOS device.)

4. If you have security keys enabled, you’re prompted to activate one.

5. On the “Change Password” screen that appears, you must enter a new password and verify it.

6. Tap Change.

Your Apple ID password is now changed. Your other devices will ask you to enter the new password when you use them.

Reset a Password in macOS with 2FA Enabled

Here’s how to reset a password for your Apple ID account with code-based 2FA or security keys enabled in macOS:

1. Go to System Preferences > Apple ID > Password & Security (Monterey) or System Settings > Account Name > Sign-In/Password & Security (Ventura or later).

2. Click the Change Password button.

3. You may be prompted to enter a password for an administrative account, and you should do so and click OK.

4. If you have security keys enabled, you’re prompted to activate one.

5. A Change Password dialog appears. Enter your new password and enter it again in the Verify field.

6. Click Change.

Your password is now changed. Your other devices will ask you to enter the new password when you use them.

Reset a 2FA Password on the Apple ID Website

You can also use the Apple ID iForgot website to change an account password if you’re using code-based 2FA, but it requires hopping through a few hoops, and switching to one of your devices to complete the process.

Here’s how to proceed with code-based 2FA only:

1. Visit the Apple ID iForgot website.

2. Enter your Apple ID email address and click Continue.

3. Apple displays phone numbers associated with the Apple ID with all but the last two digits replaced with bullets, like (•••) •••-••12. Enter the full phone number for any of those and click Continue.

4. As with a 2FA login, a dialog appears on your trusted devices, a list of which Apple shows on the site (Figure 31). Find any of those devices and tap Show or click Allow in the Reset Password message.

   

5. If prompted, click or tap Reset Password (Figure 32).

   

6. Enter your device passcode or macOS account password and click Continue.

7. Enter a new password and then re-enter it in the Verify field, and tap Next or click Change.

Your password is now changed and may need to be re-entered in a number of locations.