Two-Factor Authentication (Email 2FA) Guide
Your email is the gateway to account recovery, onboarding, exchanges, and critical services. If someone gains access to it, they can often reset passwords, bypass security, or impersonate you. For Bitcoin holders, securing email is non-negotiable.
At minimum, enable two-factor authentication (2FA) on your email. For the strongest protection, use a hardware security key (YubiKey)—see our YubiKey guide for setup. Below are official provider links to enable 2FA (and, where applicable, security keys) for the most common email services.
Enable 2FA by Provider
Use each provider’s official instructions to turn on two-factor authentication. We link to their support pages only; steps may change, so always follow the current guide on their site.
Gmail / Google
Google calls it “2-Step Verification.” Enable it on your Google Account so that sign-in requires your password plus a second step (phone prompt, authenticator app, or security key).
Enable 2FA: Google: Turn on 2-Step Verification
Use a security key: Google: Use a security key for 2-Step Verification
Outlook / Microsoft
Microsoft accounts (Outlook.com, Office 365) support two-step verification via the Security info page. You can use an authenticator app, SMS, or a security key.
Proton Mail
Proton supports 2FA via an authenticator app and optionally a FIDO2/U2F security key. Enable the authenticator first, then you can add security keys.
Enable 2FA: Proton: Two-factor authentication (2FA)
Use a security key: Proton: How to use a 2FA security key
iCloud / Apple ID
Two-factor authentication for Apple ID is required for many Apple services and protects iCloud, App Store, and device sign-in. For the strongest protection, add hardware security keys (Apple supports FIDO2 keys).
Enable 2FA: Apple: Two-factor authentication for Apple Account
Use a security key: Apple: How to use security keys with your Apple ID
Other providers
If you use another email provider, look for “Security,” “Two-factor authentication,” or “2FA” in your account settings and follow their official instructions.
Strongest Protection: Use a YubiKey
Hardware security keys resist phishing and SIM swap attacks better than SMS or authenticator apps. If your email supports it, add a YubiKey as a second factor and keep a backup key in a safe place.
See our step-by-step YubiKey guide for Apple ID, Gmail, and other critical accounts.
Educational only — no financial, tax, or legal advice. Provider links are to official support pages; we do not control and are not responsible for third-party content. Seek appropriate licensed professionals where required.
About the Author
This guide was written by Andy Pattinson, Founding Partner with expertise in Bitcoin security operations and hardware authentication.