How to Turn On Two-Factor Authentication for Your Google Account
A password alone is the only thing standing between a stranger and your Gmail, your photos and every account that resets through Google. Two-factor authentication — Google calls it 2-Step Verification — adds a second check that only you can pass. This guide turns it on, saves the backup codes that rescue you if your phone goes missing, and shows you the sign-in prompt to expect afterwards.
Before you start
You need your Google Account password, a phone that can receive prompts or run an authenticator app, and a safe place to store backup codes. Menus may look slightly different by version.
Which second step should you pick?
Before you pick, here is how the three main second steps compare, in plain terms. Whichever you choose, plan for losing your phone now, not later: the first move if it goes missing is a backup code, and the section below explains where to find one.
- Text message code: the simplest to set up, and it works on any phone. The weakness is that the code travels over the mobile network, so it is the easiest of the three to intercept if someone tricks your carrier into moving your number — still far better than no second step at all.
- Authenticator app: an app on your phone generates a new code every 30 seconds, with no signal and no phone number involved. This is the best balance of safety and convenience for most people.
- Security key: a small physical key you plug in or tap when you sign in. It is the hardest of the three to phish, because the key only works on the real Google sign-in page — but it costs money, and losing your only key with no backup codes means a long account-recovery process.
Steps
- Open your Google Account Security settings. Sign in at myaccount.google.com, then choose Security from the menu.
- Open 2-Step Verification. Under “How you sign in to Google”, select 2-Step Verification and sign in again if asked.
- Add a phone prompt or authenticator app. Follow the on-screen steps to add a Google prompt on your phone, or choose Authenticator app and scan the code with your authenticator app.
- Save backup codes in a safe place. On the 2-Step Verification page, open Backup codes, download or print them, and store them somewhere safe. Do not store them only on the same device you sign in with.
What to check
Sign out and sign in again to confirm you are asked for the second step. Check that your phone prompt or authenticator code works, and confirm your backup codes are stored where you can find them if you lose your phone.
What changes after this
With 2-Step Verification on, anyone who learns your password still cannot sign in without your phone, your codes, or your key. The small extra tap at sign-in buys real protection for the account that unlocks everything else — Gmail, photos, and every password reset that flows through Google.
Backup codes and what to do if you lose your phone
Backup codes are one-time codes you can use to sign in when your usual second step is not available. Save them when you set up 2-Step Verification, before you need them.
- Use backup codes if you lose your phone. On the sign-in screen, choose the option to try another way to sign in, then enter one of your backup codes. Each code can normally be used only once, so cross it off after you use it.
- Use account recovery if you have no backup codes. Follow the sign-in recovery steps on the Google sign-in screen, answer the questions as accurately as you can, and follow the instructions Google gives you to regain access.
- Keep codes offline safely. Print your backup codes or write them down and store them in a safe place at home, separate from your phone. Do not store them in an unprotected note on the phone itself, and do not share them with anyone.
- Replace codes after use. Once you are signed in again, generate a new set of backup codes on the 2-Step Verification page and store the new set safely, since used codes no longer work.
Related guides: browse more guides in the Cybersecurity category, and see How to Use ChatGPT to Summarise a Long Article.
Second step on, backup codes saved somewhere safe? That is the account that unlocks everything else now protected by more than a password. If the phone ever goes missing, the first move is a backup code, not panic — and the section above says where to find one. For more account-safety basics, and the Cybersecurity guides.