Why you might want to disable two-step verification

Two-step verification adds a second security layer — usually a code sent to your phone or generated by an app — that you enter after your password. It stops someone from accessing your account even if they have your password. But there are real reasons to turn it off: you lost access to the phone number or authenticator app it uses, you're setting up a new device and the old one is gone, or you straightforward find the extra step too inconvenient for an account that doesn't hold sensitive information.

Disabling two-step verification is straightforward on most platforms, but the exact steps depend on which service you use and whether you still have access to your second factor. If you're locked out because you can't receive the code, you'll need a backup method — usually backup codes you saved when you first turned on two-step verification, or a recovery email address.

Key Takeaways

  • Most services let you turn off two-step verification from your account settings, but you need to pass the second factor first — meaning you need access to your phone, authenticator app, or backup codes.
  • If you set up backup codes when you enabled two-step verification, save them somewhere safe now; they're your way back in if you lose your phone.
  • Each service stores two-step settings in a different place: Gmail uses Security settings, Microsoft uses Security basics, Facebook uses Settings and Privacy, and so on.
  • If you can't access your second factor and have no backup codes, contact the service's support team with proof of account ownership — this usually takes several days.

Disabling two-step verification when you still have access

If you can still receive codes or access your authenticator app, the process is the same on nearly every platform: go to your account settings, find the security or two-step section, and look for a button that says "Turn off", "Disable", or "Remove". You'll be asked to enter your password and then confirm the code from your second factor one more time. After that, two-step verification is off.

The location of this setting varies by service. On Gmail, go to myaccount.google.com, click Security on the left, scroll to "How you sign in to Google", and click 2-Step Verification. On Microsoft accounts, go to account.microsoft.com, click Security, then Advanced security options, then 2-Step Verification. On Facebook, click the menu in the top right, go to Settings and Privacy, then Settings, then Security and login, then find Two-factor authentication. Once you find the setting, the disable button is usually obvious.

After you turn off two-step verification, test your login on a different device to make sure it worked. Sign out completely, close your browser, and try signing back in with just your password — no code should be requested.

Using backup codes if you lost your phone

When you first turned on two-step verification, most services gave you a set of backup codes — usually 8 to 10 single-use codes you could use if you lost access to your phone. If you saved these codes, you can use one of them to get back into your account and disable two-step verification.

During the sign-in process, after you enter your password, you'll see an option that says something like "Can't access your phone?" or "Use a backup code instead". Click that, enter one of your backup codes, and you'll be let in. From there, follow the steps above to disable two-step verification. Write down any remaining backup codes before you do — they're now useless, but it's good to know you used them up.

If you didn't save your backup codes and can't access your second factor, you'll need to contact the service's support team. Have your recovery email address ready and be prepared to answer security questions or provide other proof that you own the account.

Disabling two-step verification on Google accounts

Go to myaccount.google.com and sign in. Click Security on the left side. Under "How you sign in to Google", click 2-Step Verification. Click Turn off. Google will ask you to confirm your password and then show you a code on your phone or authenticator app. Enter that code, and two-step verification is disabled.

If you no longer have access to the phone number or authenticator app you set up, click "Can't use your phone?" on the sign-in screen and select "Use a backup code". If you have no backup codes and can't access your recovery email, go to accounts.google.com/signin/recovery to start the account recovery process. Google will ask you to verify your identity through your recovery phone number, recovery email, or answers to security questions you set up earlier.

Disabling two-step verification on Microsoft accounts

Go to account.microsoft.com and sign in. Click Security on the left. Under "Advanced security options", click 2-Step Verification. Click Turn off. Microsoft will ask you to confirm your password and then send a code to your phone or email. Enter that code to complete the process.

If you can't access the phone or email where codes are sent, click "I can't use my authenticator app" during sign-in and choose "Use a backup code" or "Verify another way". If you have no backup codes, Microsoft will let you verify using your recovery email or phone number. If you can't access those either, go to account.live.com/password/reset and follow the account recovery steps.

Disabling two-step verification on Facebook and Instagram

On Facebook, click the menu in the top right corner. Go to Settings and Privacy, then Settings. Click Security and login on the left. Find Two-factor authentication and click Edit. Select the method you want to remove (usually your phone number or authenticator app) and click Remove. Facebook will ask you to enter your password to confirm.

On Instagram, go to your profile, tap the menu icon, and select Settings and privacy. Tap Security, then Two-factor authentication. Tap the method you want to remove and select Remove. You'll need to enter your password to confirm. If you've lost access to your phone or authenticator app, you can use a backup code if you saved one, or contact Instagram support through the app.

What to do if you're completely locked out

If you can't access your password, your second factor, your backup codes, or your recovery email, you're locked out. Contact the service's support team directly. Have ready: the email address on the account, any phone numbers associated with it, the approximate date you created it, and any recent transactions or activity you remember. The support team will ask security questions or request other proof that you own the account.

This process usually takes three to seven business days. During that time, the service may lock your account to prevent someone else from accessing it while the recovery is in progress. Once support confirms your identity, they can disable two-step verification for you or help you regain access to your second factor.

To avoid this situation in the future, save your backup codes in a safe place — a password manager, a locked drawer, or a safe deposit box. Update your recovery email and phone number if they change. And if you use an authenticator app, make sure you know which accounts it protects; if you get a new phone, you'll need to set up the app again on the new device before you lose access to the old one.

Frequently Asked Questions

Will disabling two-step verification make my account less find?

Yes. Two-step verification stops attackers who have your password from getting in. Without it, your account is protected only by your password. If that password is weak or used on other sites, your account is at higher risk. Consider disabling two-step verification only for accounts that don't contain sensitive information or financial data.

Can I disable two-step verification temporarily and turn it back on later?

Yes. You can turn it off and on as many times as you want. If you're disabling it because you're switching phones, you can turn it back on once your new phone is set up and you've installed your authenticator app or confirmed your new phone number.

What's the difference between backup codes and recovery codes?

They're usually the same thing — a set of single-use codes generated when you turn on two-step verification. Different services use different names, but they work the same way: enter one during sign-in if you can't access your second factor. Once you use a code, it's gone and can't be used again.

If I disable two-step verification, do I need to do anything else?

No. Disabling two-step verification doesn't affect your password, recovery email, security questions, or any other account settings. You can still sign in with your password alone. If you want to re-enable two-step verification later, you can do so from the same security settings.

What if my authenticator app shows a code but the service says it's wrong?

Authenticator apps generate codes that change every 30 seconds. If the code expired while you were typing it, try the next one. If codes keep being rejected, your phone's clock may be out of sync with the service's clock. Go to your phone's settings, turn off automatic time adjustment, manually set the time to match your computer or a clock, then turn automatic adjustment back on. Try the code again.