Password · guide

How to turn off two factor authentication where you still can

By Alberto Gulotta · Updated 10 September 2026 · 14 min read

How to turn off two factor authentication: sign in first, then find it in the account’s security settings — on Google, under 2-Step Verification; on a Microsoft account, under Manage how I sign in. Then two clean-ups. On some accounts the switch no longer exists at all.

1. First decide whether you want it off, or want back in. These lead to opposite places. If you have lost the phone, turning the feature off is not the route — account recovery is, and it starts from the sign-in page rather than from the settings you cannot reach.
2. Check whether the option exists for you at all. GitHub is explicit that for some accounts it does not: “if you are part of the group that GitHub is requiring to enroll in 2FA in 2023, you cannot disable 2FA. A banner will display in your authentication settings to remind you that you are not allowed to disable 2FA.”
3. On Google: Security & sign-in, then 2-Step Verification, then Turn off. Google’s own path, and its own framing before you start: “if you turn off 2-Step Verification, you remove an additional layer of security, which can make it easier for someone else to access your account.”
4. On a Microsoft account: account.microsoft.com/security, Manage how I sign in, then Turn off. Microsoft puts the switch under “Additional security and Two-step verification”, with Turn on and Turn off in the same place.
5. Then destroy the backup codes. This is Google’s instruction, not ours: “destroy all the backup codes that you’ve saved for signing in to this account.” Codes printed for an account that no longer uses them are a set of keys with nothing to say who holds them.
6. Then revoke the app passwords. Google: “if you use app passwords to let apps access your Google Account, you may get errors when you turn off 2-Step Verification”, and it recommends removing them. Microsoft states the same dependency from the other end: “app passwords are only available if you use two-step verification.” And while it is on, codes will keep arriving — including, occasionally, ones nobody asked for.
7. If the goal was fewer prompts rather than less security, stop here and change method instead. A passkey or a security key on the same account removes the typing without removing the protection, and it is a change in the same settings screen.

The question underneath this one is usually a different question. Two very different situations arrive at the same search. In the first, the feature works and it is a nuisance: a code every morning on a laptop that never leaves the house. In the second, the phone is gone, or the authenticator was wiped with it, and turning the feature off looks like the way back in. It is not. Every switch on this page sits behind a completed sign-in, which is exactly what the second situation does not have. The route there is account recovery, from the sign-in page, using whatever second method was registered — and if none was, a conversation with the service.

Google states the cost before it states the steps. Its page opens with the consequence rather than the steps: “2-Step Verification makes your account more secure. If you turn off 2-Step Verification, you remove an additional layer of security, which can make it easier for someone else to access your account.” That framing is worth borrowing before you do it anywhere, because it is the accurate description of the trade. Nothing else changes; one layer is removed, and a password on its own becomes sufficient.

The clean-ups matter because they leave real keys lying around. A backup code is not a reminder, it is a credential: a string that opens the account when nothing else will. A sheet of them printed in 2024 and left in a drawer keeps that property after the feature is off, which is why Google’s instruction is to destroy them rather than to file them. App passwords have the same shape from the other direction — long strings granted to a mail client or a device, each of them a way in that outlives the arrangement that created it.

If the real complaint is the typing, there is a better change in the same screen. A passkey or a hardware key on the account removes the daily code without removing the second factor: the browser and the device check each other, and there is nothing to read out, type or lose. That is a change of method rather than a removal of protection, and on most of the services in the table above it lives two rows below the switch this page is about.

The Google steps, the warning about backup codes and app passwords and the framing about removing a layer are quoted from Google Account Help. The GitHub sentences about accounts that cannot disable the feature, about outside collaborators and about losing access to organisations are quoted from GitHub Docs. The Microsoft path, the note about app passwords and the line about phasing out SMS are quoted from Microsoft Support. All three were read on 7 September 2026.

Not covered here. It will not cover every service. The three here are the ones whose own documentation states a consequence rather than only a path.

It will not help with an account you cannot sign into. That is recovery, and it begins at the sign-in page.

And it will not recommend turning the feature off. It will tell you where the switch is, what each service says it costs, and what it leaves behind. What holds instead is simple: every consequence on this page is quoted from the service’s own documentation, with the date it was read, rather than summarised from memory.