How to Set Up 2-Step Verification for Your Google Account

Your Google account is probably the most important account you own. Gmail, Drive, Photos, YouTube, Google Pay, and the password reset link for half the other accounts you have all live behind it. If someone steals your password, they get everything.

2-Step Verification (2SV) fixes that. Even if a thief has your password, they still need a second thing — usually your phone — to get in. Setting it up takes about five minutes, and once it's on, you barely notice it.

Here's how to do it.

What You'll Need

• A computer or phone with a web browser

• Your Google account password

• A smartphone you have with you (this becomes your second step)

If you don't own a smartphone, you can still use 2SV — you'll just receive codes by text or voice call instead. We'll cover that too.

Open Your Google Account Security Page

Go to myaccount.google.com/security and sign in if you're prompted.

You'll land on the Security page. This is mission control for everything related to keeping your account safe.

Find "2-Step Verification" and Click "Get Started"

Scroll down to the section labeled "How you sign in to Google." You'll see an option called 2-Step Verification. Click it.

On the next screen, click Get Started. Google will ask you to re-enter your password — that's normal and expected. It just wants to make sure it's actually you making this change.

Pick Your Second Step

This is where you choose how Google will verify it's you when you sign in. Google will usually recommend a method based on what's available, but you have options. Here's how to think about them, from best to "good enough":

Best: Passkey or Google Prompt

A passkey uses your phone's fingerprint or face scan to sign you in. No code to type — you just confirm on your phone. It's the most secure and the most convenient. If you have a modern iPhone or Android, this is what you want.

A Google prompt is the next best thing. When someone tries to sign in, your phone buzzes with a "Yes, that's me / No, it's not me" notification. Tap yes, and you're in. To use prompts, your phone needs to be signed in to your Google account in the Gmail, YouTube, or Google app.

Strong: Authenticator App

Apps like Google Authenticator, Authy, or 1Password generate a fresh 6-digit code every 30 seconds. You open the app, glance at the code, type it in. This works even when you have no cell signal or Wi-Fi — handy when traveling.

Acceptable: Text Message or Phone Call

Google can text you a 6-digit code, or call you and read it aloud. This is the easiest to set up and works on any phone, including landlines for voice calls. The downside: it's the least secure option, because attackers can sometimes hijack phone numbers through what's called a "SIM swap" scam. It's still much better than no second step at all.

Pick one to start. You can add more later, and you should.

Follow the Prompts to Finish Enrollment

Google will walk you through the rest. Depending on what you picked:

• For a Google prompt: It'll show you which phones are eligible. Pick yours and confirm.

• For an authenticator app: Google will display a QR code. Open your authenticator app, tap to add a new account, and scan the code. Then type the 6-digit code from your app back into Google to confirm it's working.

• For text or call: Enter your phone number, choose text or voice, and type in the code Google sends you.

Once Google confirms it works, click Turn On. You're done with the basic setup.

Save Your Backup Codes (Don't Skip This)

This is the step everyone wants to skip and later regrets. Back on the 2-Step Verification page, scroll down to Backup codes and click Set up or Show codes.

Google will give you a list of ten 8-digit codes. Each one works exactly once. If you ever lose your phone, break it, or get locked out for any reason, these codes are your way back in.

Where to put them:

• Print them and put them in a safe, a filing cabinet, or with your important documents

• Save them in a password manager like 1Password or Bitwarden

• Write them in a notebook you keep somewhere secure

Where not to put them: A sticky note on your monitor. A text file on your desktop called "google codes.txt." An email to yourself titled "backup codes." You get the idea.

Add a Backup Method

While you're here, set up a second method. If your phone dies and you don't have your backup codes handy, a backup method saves the day. A common combo:

• Primary: Google prompt on your phone

• Backup: Authenticator app on the same phone, plus printed backup codes

Or if you really want to lock things down, buy a hardware security key like a YubiKey (around $50). It's a small USB device that proves you have it physically present. Phishing attacks essentially can't beat it.

What Signing In Looks Like Now

From now on, when you sign in to your Google account on a new device:

1. Enter your email and password as usual.

2. Google asks for your second step — a tap on your phone, a code from your app, or whatever you set up.

3. You're in.

On devices you trust (your personal laptop, your phone), you can check "Don't ask again on this computer" and Google will skip the second step on that specific device. Don't check this on a friend's laptop or a public computer.

A Few Common Questions

What if I lose my phone? Use a backup code, or use your backup method. If you have neither, Google has an account recovery process — but it can take days and isn't guaranteed to work. This is why backup codes matter.

Does this make signing in slower? A few seconds on new devices. On devices you mark as trusted, you won't notice it at all.

Can I turn it off later? Yes, from the same Security page. But please don't.

What about my other accounts? Most major services — Apple, Microsoft, Facebook, your bank, Amazon — offer 2SV too. The same logic applies. Turn it on everywhere that matters.

The Bottom Line

Setting up 2-Step Verification is the single most effective thing you can do to keep your Google account safe. Passwords get leaked in data breaches every week — yours has probably been in one already. 2SV makes those leaks mostly harmless, because a password alone isn't enough to get in anymore.

Five minutes now beats a week of trying to recover a hijacked account. Open that security page and turn it on.