Two-step verification for Apple Account

If you can’t use two-factor authentication with your account, for example if your device uses iOS 8 or OS X Yosemite or earlier, you can keep your Apple Account secure with two-step verification instead.

• Is two-step verification the same as two-factor authentication?

• What is two-step verification for Apple Account?

• How does it work?

• Do I still need to remember any security questions?

• Which SMS numbers should I verify for my account?

• How do I use Find My iPhone notifications to receive verification codes?

• What do I need to remember when I use two-step verification?

• Where should I keep my Recovery Key?

• What if I lose my Recovery Key?

• How do I sign in to my account using an app that doesn’t support entering two-step verification codes?

• What if I forget my Apple Account password?

• What if I lose or give away one of my trusted devices?

• What if I no longer have access to any of my trusted devices?

• How do I turn off two-step verification?

• How do I switch from two-step verification to two-factor authentication?

• Where is two-step verification available?

If you use iOS 9 or OS X El Capitan or later, you probably use two-factor authentication instead of two-step verification. If you’re not sure which security method you use, check with these steps.

Is two-step verification the same as two-factor authentication?

No. Two-factor authentication is a newer security method that’s built directly into iOS, iPadOS, macOS, tvOS, watchOS and Apple’s websites. It offers a more streamlined user experience and is required to use certain features that call for enhanced security. Two-factor authentication is available to iCloud users with at least one device using iOS 9 or OS X El Capitan or later.

If you have Apple devices that can be updated to iOS 9 or later or OS X El Capitan or later, you should set up two-factor authentication instead. If you use two-step verification for your Apple Account, and then you upgrade to iOS 11 or later, or macOS High Sierra or later, your security settings may be automatically upgraded to two-factor authentication.

Two-step verification is an older security method that is available to users who don’t have Apple devices, can’t update their devices, or are otherwise ineligible for two-factor authentication. You can no longer set up two-step verification for your Apple Account, but if you already use it, you can keep using it.

What is two-step verification for Apple Account?

Two-step verification is a security feature for Apple Account that’s designed to prevent anyone else from accessing or using your account, even if they know your password.

It requires you to verify your identity using one of your devices or another approved method before you can:

• Sign in on your Apple Account page

• Sign in to iCloud on a new device or at iCloud.com

• Sign in to iMessage or FaceTime*

• Make a purchase in the App Store or other Apple media services on a new device

• Get Apple Account-related support from Apple

How does it work?

When you set up two-step verification, you register one or more trusted devices. A trusted device is a device you control that can receive 4-digit verification codes using either SMS or Find My iPhone. You’re required to provide at least one SMS-capable phone number.

Then, whenever you sign in to manage your Apple Account, sign in to iCloud or make purchases in the App Store or other Apple media services on a new device, you need to verify your identity by entering both your password and a 4-digit verification code.

After you sign in, you can securely access your account or make purchases as usual. Without both your password and the verification code, access to your account is denied.

You’ll also get a 14-character Recovery Key to print and keep in a safe place. Use your Recovery Key to regain access to your account if you ever lose access to your trusted devices or SMS-capable phone number or forget your password.

Do I still need to remember any security questions?

With two-step verification, you don’t need to create or remember any security questions. Your identity is verified exclusively using your password, verification codes sent to your trusted devices or SMS-capable phone number and your Recovery Key.

Which SMS numbers should I verify for my account?

You’re required to verify at least one SMS-capable phone number for your account. You should consider verifying all SMS-capable phone numbers you normally use with your iPhone or another mobile phone. You should also consider verifying an SMS-capable phone number used by someone close to you, such as a spouse or other family member. You can use this number if you’re temporarily without access to your own devices.

Add or remove an SMS number

1. Go to account.apple.com and sign in to your Apple Account.

2. In the Sign-In and Security section, click Account Security.

3. Click Add a trusted phone number.

4. To add a number, enter the phone number, then click Continue.

5. Enter the verification code sent to the phone number.

6. To remove a number, click Remove This Trusted Phone Number next to the phone number you want to remove.

How do I use Find My iPhone notifications to receive verification codes?

Find My iPhone notifications can be used to receive verification codes on any iOS device with Find My iPhone turned on. Find out how to set up Find My iPhone.

What do I need to remember when I use two-step verification?

Two-step verification simplifies and strengthens the security of your Apple Account. After you turn it on, there’s no way for anyone to access and manage your account other than by using your password, verification codes sent to your trusted devices or SMS-capable phone number, or your Recovery Key. Only you can reset your password, manage your trusted devices or create a new Recovery Key. Apple Support can help you with other aspects of your service, but they aren’t able to update or recover these three things for you. When you use two-step verification, you are responsible for:

• Remembering your password

• Keeping your trusted devices physically secure

• Keeping your Recovery Key in a safe place

If you lose access to two of these three items at the same time, you could be locked out of your Apple Account permanently.

Where should I keep my Recovery Key?

Keep your Recovery Key in a secure place in your home, your office or another location. Consider printing more than one copy, so that you can keep your key in more than one place. Your key will be easier to find if you ever need it and you will have a spare copy if one is ever lost or destroyed. You shouldn’t store your Recovery Key on your device or computer, because that could give an unauthorised user instant access to your key.

If you ever need a new Recovery Key, find out how to create a new Recovery Key.

What if I lose my Recovery Key?

You can sign in on your Apple Account page and create a new Recovery Key using your Apple Account password and one of your trusted devices.

1. Go to account.apple.com using a trusted device.

2. Sign in to your Apple Account.

3. In the Sign-In and Security section, click Recovery Key > Change Recovery Key.

Keep your new Recovery Key in a safe place. Your old Recovery Key won't work anymore and you can’t use it to reset your password or access your account. If you can’t see Recovery Key in the Sign-In and Security section, then you are not using two-step verification.

How do I sign in to my account using an app that doesn’t support entering two-step verification codes?

You can generate an app-specific password from your Apple Account page and enter it into the password field of the app that you want to sign in to. This allows you to sign in securely even if the app you’re using doesn’t support entering verification codes. For example, you might use an app-specific password to sign in to iCloud using a third-party email, address book or calendar app.

Find out how to generate and use app-specific passwords.

What if I forget my Apple Account password?

You can reset your password at iforgot.apple.com.

Apple Support can’t reset your password for you. To reset your password, you must have your Recovery Key and access to at least one of your trusted devices.

What if I lose or give away one of my trusted devices?

If you no longer have access to one of your devices, remove that device from your list of trusted devices as soon as possible. That device can then no longer be used to help verify your identity.

What if I no longer have access to any of my trusted devices?

If you can’t access any of your trusted devices, you can still access your account using your password and Recovery Key, or with your password and SMS-capable phone number.

1. Go to account.apple.com, and sign in to your Apple Account.

2. On the Verify your Identity screen, select “Can't access your trusted devices?”.

3. In the pop-up window, enter your Recovery Key.

4. Go to the Devices section and remove the device you no longer wish to use to verify your identity.

How do I turn off two-step verification?

Make sure that you’re still signed in to iCloud on each of your devices. You might be asked for your Apple Account password.

1. Sign in to account.apple.com.

2. In the Sign-In and Security section, click Account Security.

3. Click Turn Off two-step verification. Click again to confirm.

4. Create new security questions and verify your date of birth.

You’ll get an email confirming that two-step verification for your Apple Account is off.

How do I switch from two-step verification to two-factor authentication?

If you’re using two-step verification, we’ll automatically update your account to two-factor authentication when you sign in on a device with iOS 11 or later or macOS High Sierra or later. You can also switch your account manually from two-step verification to two-factor authentication using the steps below.

Confirm which feature you’re using

If you’re not sure if you have set up two-step verification or two-factor authentication, use these steps:

1. Sign in to account.apple.com.

2. In the Sign-In and Security section, look for two-step verification or two-factor authentication under Account Security.

3. If two-step verification is on, continue with the steps to turn it off, then turn on two-factor authentication. If two-factor authentication is on, you’re already set up.

Turn on two-factor authentication

Before you can turn on two-factor authentication, turn off two-step verification. Also remember to make sure that you’re still signed in to iCloud on each of your devices. You might be asked for your Apple Account password*.

Find out how to set up two-factor authentication for your Apple Account.

Where is two-step verification available?

Two-step verification is available in the countries and regions below for existing accounts.

• Albania

• Algeria

• Angola

• Anguilla

• Antigua and Barbuda

• Argentina

• Armenia

• Australia

• Austria

• Bahamas

• Bahrain

• Bangladesh

• Barbados

• Belgium

• Bolivia

• Botswana

• Brazil

• British Virgin Islands

• Bulgaria

• Cameroon

• Canada

• Cayman Islands

• Central African Republic

• Chad

• Chile

• China mainland

• Colombia

• Congo, Democratic Republic

• Congo, Republic

• Costa Rica

• Cote d’Ivoire

• Croatia

• Cyprus

• Czechia

• Denmark

• Dominica

• Dominican Republic

• Ecuador

• Egypt

• El Salvador

• Estonia

• Eswatini

• Fiji

• Finland

• France

• Gambia

• Germany

• Ghana

• Greece

• Grenada

• Guam

• Guadeloupe

• Guatemala

• Guinea

• Guinea-Bissau

• Guyana

• Honduras

• Hong Kong

• Hungary

• Iceland

• India

• Indonesia

• Ireland

• Israel

• Italy

• Jamaica

• Japan

• Jordan

• Kazakhstan

• Kenya

• Kosovo

• Kuwait

• Laos

• Latvia

• Lebanon

• Liechtenstein

• Lithuania

• Luxembourg

• Macao

• Madagascar

• Malaysia

• Mali

• Malta

• Martinique

• Mauritius

• Mexico

• Moldova

• Montserrat

• Morocco

• Namibia

• Netherlands

• New Zealand

• Nicaragua

• Niger

• Nigeria

• North Macedonia

• Norway

• Oman

• Pakistan

• Palau

• Panama

• Paraguay

• Peru

• Philippines

• Poland

• Portugal

• Puerto Rico

• Qatar

• Reunion

• Romania

• Russia

• Saint Kitts and Nevis

• Saint Lucia

• Saint Vincent and Grenadines

• Sao Tome and Principe

• Saudi Arabia

• Senegal

• Seychelles

• Sierra Leone

• Singapore

• Slovakia

• Slovenia

• South Africa

• South Korea

• Spain

• Sri Lanka

• Suriname

• Sweden

• Switzerland

• Taiwan

• Tanzania

• Thailand

• Trinidad and Tobago

• Tunisia

• Türkiye

• Turks and Caicos Islands

• Uganda

• Ukraine

• United Arab Emirates

• United Kingdom

• United States

• Uruguay

• Venezuela

• Vietnam

• Yemen

• Zimbabwe