PayPal 2FA setup
PayPal supports standard TOTP as its authenticator-app option for 2-step verification — stronger than the default SMS codes, because a phone number can be hijacked by a SIM swap and money flows through PayPal. Worth knowing: PayPal keeps SMS as a fallback method unless you manage your methods, so check what's enrolled after setup.
Fact-checked against PayPal's official documentation · last reviewed 10 November 2026 · how we review guides
Reviewed by the 2FA COUNTER security editorial team · our editorial methodology
Open the generator for PayPalStep by step
- 01
Open PayPal security settings
Sign in at paypal.com → click the gear icon (Settings) → “Security”. Find the “2-step verification” section. Business accounts may find it under Account Settings instead of Profile Settings.
- 02
Start 2-step verification setup
Click “Set Up” (or “Update”) next to 2-step verification. PayPal offers SMS and “Use an authenticator app” — choose the authenticator app option. It is the standard TOTP factor, independent of your phone number.
- 03
Reveal the secret
PayPal shows a QR code plus a Base32 “secret key” line for manual entry. Copy the key — or screenshot the QR and paste the image into the page, the parser reads it locally.
- 04
Generate, verify, activate
Paste into 2facounter.com, copy the live code, and paste it back into PayPal’s confirmation field. 2-step verification flips to active and PayPal starts asking for a code at sign-in.
- 05
Audit your methods
Back on the 2-step verification screen, check every enrolled method. If SMS is still listed as a second method, decide deliberately whether to keep it — it’s a weaker fallback than a saved recovery code. If PayPal offers recovery codes, download them now.
FAQ
Does PayPal require 2FA?
Personal accounts can enable it voluntarily; PayPal requires 2-step verification for some business and seller accounts, especially those handling higher volumes. Either way, enabling it on a money-mover account is one of the highest-value two minutes in personal security.
SMS codes vs authenticator app on PayPal — which should I pick?
Authenticator app, always. SMS codes die with your SIM: a SIM-swap attacker who ports your phone number receives your codes. TOTP lives on the device (or in this browser) and never transmits anything.
I lost my phone and can’t get PayPal codes — what now?
If you saved recovery codes, use one at sign-in. If SMS was kept as a fallback, that still works. If neither exists, PayPal support verifies your identity through account details and restores access — which is slower and more painful than saving recovery codes today.
Codes rejected right after setup — what broke?
Clock drift almost always. TOTP codes depend on your device clock matching PayPal’s server within a tight window — if your system clock is even ~30 s off, every guess fails. Set your OS to sync time automatically, wait for the next 30-second step, and try once more.