How to Turn Off or Disable Two-Factor Authentication

In short: Google and Microsoft let you turn off two-factor authentication from your account's security settings, but Apple only allows it within two weeks of turning it on, and not at all if the account was created with two-factor authentication already on, according to Apple's support page. Every provider that still allows it warns in writing that removing this step makes an account easier to break into.

If you're searching for how to turn off two-factor authentication, you probably have a specific reason: a lost phone, an app that keeps breaking, or plain frustration with the extra step at login. Before you do it, know that every major provider tells you this weakens your account, and at least one of them won't even let you do it anymore. Here's how each platform actually handles it, and what to weigh first.

How do I turn off two-factor authentication on Google, Microsoft, or Apple?

Google

1. Go to myaccount.google.com and open Security.
2. Find the sign-in section and select 2-Step Verification. You may need to sign in again.
3. Select Turn off.
4. Confirm by selecting Turn off again when prompted.

Google's own help page for turning off 2-Step Verification walks through this exact flow and adds two follow-up steps people often skip: it tells users to destroy any saved backup codes for the account, and to check any app passwords tied to two-factor sign-in. Google's guidance on app passwords reads: "If you use app passwords to let apps access your Google Account, you may get errors when you turn off 2-Step Verification. If this happens, re-enter your Google Account password."

Microsoft

1. Sign in to your Microsoft account and open its security settings.
2. Find the two-step verification setting listed among your account's security options and follow the on-screen option to disable it.

Microsoft's account security guide doesn't publish a fixed click path, but the toggle sits in the same security settings area where you switched two-step verification on.

Apple

Apple makes this the hardest of the three, on purpose. If you're within two weeks of turning two-factor authentication on, you can still back out. Per Apple's Personal Safety User Guide: "After you turn on two-factor authentication, you have a two-week period during which you can turn it off. After that, you can't turn off two-factor authentication. To turn it off, open your confirmation email and click the link to return to your previous security settings."

1. Open the confirmation email Apple sent when you enabled two-factor authentication.
2. Click the link in that email to return to your previous security settings.

If what you actually want is to remove a single trusted phone number rather than disable two-factor authentication entirely, Apple handles that separately from the two-week window above. On an iPhone or iPad, go to Settings > [your name] > Password & Security, tap Edit next to Trusted Phone Numbers, and remove the number; on a Mac or at the Apple ID website, the same option sits under Password & Security or the Security section. Before doing this, confirm another trusted device is still signed into the account — Macworld's guide to Apple ID trusted phone numbers warns: "It's simple to remove a trusted number, but you must be sure first that you still have access to other trusted devices for the account. Otherwise, you could lock yourself out."

If your two-week window has closed, you're not missing a setting — Apple has simply removed the option, as the same guide makes clear.

There's a bigger wrinkle. Apple's support page on two-factor authentication states plainly: "If your Apple Account was created using two-factor authentication, this extra protection can't be removed." The same page notes that two-factor authentication is now the standard security setup for most accounts, and that some Apple features, including Apple Pay and Sign in with Apple, won't work without it — so removing it isn't an option if you rely on those.

Is it safe to disable two-factor authentication?

Every provider that lets you do this tells you not to, in writing. Google's warning, on its account help page, reads in full: "2-Step Verification makes your account more secure. If you turn off 2-Step Verification, you remove an additional layer of security, which can make it easier for someone else to access your account." Apple makes the same point on its own support guide, warning that "turning off two-factor authentication makes your account less secure and means you can't use features that require a higher level of security."

Two-factor authentication works by requiring something you know (your password) plus something you have (a code, a device, a key). Turning it off drops you back to a password alone. If that password has ever been reused, leaked in a breach, or guessed, there's nothing standing between whoever has it and your account. That's the reason these companies built the feature in the first place, and why Apple no longer lets newer accounts turn it off at all.

Why did the FBI and CISA warn against SMS codes specifically?

In December 2024, the FBI and the Cybersecurity and Infrastructure Security Agency jointly told Americans to stop using text messages as a second login factor. CISA's guidance, as quoted in 1Password's breakdown of SMS-based MFA risks, is direct: "Do not use SMS as a second factor for authentication. SMS messages are not encrypted–a threat actor with access to a telecommunication provider's network who intercepts these messages can read them." The advisory followed the Salt Typhoon espionage campaign, in which, as 1Password explains, "bad actors infiltrated multiple telecom companies and accessed call and data logs for an unknown number of victims." That's a separate risk from SIM swapping, where someone convinces a carrier to move your number onto a device they control — the telecom-level breach meant attackers didn't need to target any one person's number to potentially read codes meant for them.

What should I do instead of completely disabling 2FA?

If the real problem is that your current method is annoying — SMS codes that arrive late, or an app you don't trust — you don't have to give up the extra layer entirely. You can switch methods instead.

• Move from text-message codes to an authenticator app. Microsoft is already steering personal accounts in that direction, saying it "will start phasing out SMS as a method of authentication and account recovery for personal Microsoft accounts," per Microsoft's support page.
• If you specifically want to disable SMS-based two-factor codes rather than turn off 2FA entirely, switch the delivery method in your account's security settings to an authenticator app or security key instead of removing verification altogether. The U.S. National Institute of Standards and Technology classifies SMS as a restricted authenticator in its digital identity guidelines, meaning it carries known risks like number reassignment and interception, which is why agencies and companies increasingly steer users toward app-based or hardware codes instead of dropping the second factor altogether.
• Consider a passkey where the platform supports one. A passkey replaces the password-plus-code combination with a device-based credential. Privacy Unpacked has covered passkeys as a more secure alternative in more detail if you're deciding whether to switch.
• Keep a backup method on file (a secondary email, a second phone number, or printed backup codes) so a single lost device doesn't lock you out and tempt you to disable protection entirely.

What happens if I lose access to my authenticator device?

This is the scenario backup codes exist for. Google's help page tells users who turn off 2-Step Verification to "destroy all the backup codes" saved for the account, since those codes are meant to get you back in when your usual method — a phone, an app — isn't available. Rather than disabling two-factor authentication because a device was lost, the safer path is generating a fresh set of backup codes or adding a new trusted device or number before you're locked out, so you never need to fall back to a password-only account.

Before you disable 2FA anywhere, run through this checklist

1. Try switching your verification method (an authenticator app instead of SMS, or a passkey) before disabling anything outright.
2. Generate and save fresh backup codes if you might need account recovery later, then destroy the old ones as Google recommends.
3. Note any app passwords tied to two-factor authentication, since Google warns they can run into sign-in errors and may need your account password re-entered.
4. If you're unsure, leave it on — every provider covered here says the same thing: removing this layer makes it easier for someone else to get into your account.

If you're weighing a passkey as the replacement method mentioned above, see What Is a Passkey? Privacy vs Security, Explained for how synced passkeys and biometrics actually work before you switch.

Updated 8 October 2026: Added a short paragraph on disabling SMS-based codes specifically, citing NIST's restricted-authenticator guidance, and updated the title/description to match common search phrasing like "disable sms authentication" and "cancel 2 step verification."

Updated 24 October 2026: Added an In-short summary box, tightened the Apple "can't be removed" claim to match Apple's exact wording, and added a closing link to the passkeys guide.

Updated 11 November 2026: Added two sourced passages folded in from the merged SMS-authentication article: why the FBI and CISA warned against SMS codes after the Salt Typhoon telecom breach, and the specific steps (with Macworld's lockout warning) for removing a single trusted phone number from an Apple ID.