Your Gmail account is the key to your digital life. It receives password reset emails for your bank, social media, shopping and work accounts. If someone gets into your Gmail, they can often get into everything else. A strong password helps, but passwords are stolen in data breaches and phishing attacks every day. That is why two-factor authentication, which Google calls 2-Step Verification, is one of the most important security steps you can take. This guide shows you exactly how to set it up on Gmail, which second step to choose and how to avoid getting locked out.
What is two-factor authentication?
Two-factor authentication (2FA) adds a second check when you sign in. After entering your password, you also confirm your identity with something you have, such as your phone or a security key. Even if a criminal steals your password, they cannot sign in without that second factor.
2-Step Verification options for Gmail
| Method | How it works | Security level | Convenience |
|---|---|---|---|
| Google prompts | Tap “Yes” on a notification on your signed-in phone | Good | Very easy |
| Authenticator app | Enter a 6-digit code from Google Authenticator or another app | Strong | Easy |
| Passkeys | Sign in with your fingerprint, face or screen lock | Very strong, phishing-resistant | Very easy |
| Security key | Plug in or tap a physical key (USB or NFC) | Very strong, phishing-resistant | Moderate |
| Text message or voice call | Enter a code sent by SMS or call | Basic, vulnerable to SIM swaps | Easy |
| Backup codes | One-time codes for emergencies | Strong when stored safely | For backup only |
Google recommends using more than one method so you always have a way to sign in.
How to turn on 2-Step Verification (computer)
- Go to myaccount.google.com and sign in.
- Click Security in the left menu (on some layouts it is called Security and sign-in).
- Under How you sign in to Google, click 2-Step Verification.
- Click Get started or Turn on 2-Step Verification.
- Follow the prompts to add a phone number or confirm Google prompts on your phone.
- Click Turn on.
How to turn on 2-Step Verification (Android or iPhone)
- Open the Gmail app or Google app.
- Tap your profile picture, then Manage your Google Account.
- Tap the Security tab.
- Tap 2-Step Verification and follow the prompts.
Add stronger methods after turning it on
Add an authenticator app
- In 2-Step Verification settings, find Authenticator and click Set up authenticator.
- Open Google Authenticator, Microsoft Authenticator or another trusted app.
- Scan the QR code and enter the code shown to confirm.
Google Authenticator can back up codes to your Google account so you do not lose them when you switch phones.
Add a passkey
- Go to myaccount.google.com, Security, Passkeys and security keys.
- Click Create a passkey and follow the instructions using your phone or computer’s fingerprint, face recognition or screen lock.
Passkeys are phishing-resistant because they only work on the real Google website.
Add a security key
Buy a FIDO-compatible key from a reputable brand, then add it under Passkeys and security keys. Keep a second key as a backup.
Save backup codes
- In 2-Step Verification settings, select Backup codes.
- Generate a set of codes.
- Print them or store them in a secure place, such as a password manager. Each code works once.
Tips to avoid getting locked out
- Add at least two methods, such as Google prompts plus an authenticator app or passkey.
- Keep your recovery phone number and email up to date in your Google account.
- Store backup codes safely.
- Use Google Authenticator backup or transfer codes before resetting or replacing your phone.
- Keep a trusted device signed in so you can approve sign-ins.
Why text message codes are the weakest option
SMS codes are better than nothing, but criminals can intercept them through SIM swapping, where they take over your phone number. If you use SMS, also set a carrier PIN and add a stronger method like an authenticator app or passkey. Read how to check if your phone is hacked for SIM swap warning signs.
What to do if someone tries to sign in
If you receive a Google prompt or code you did not request:
- Do not approve it. Tap “No, it’s not me.”
- Change your Google password immediately.
- Check recent security activity at myaccount.google.com, Security.
- Review connected devices and sign out of any you do not recognize.
Never share verification codes with anyone. Google will never call or text asking for your code. Scammers often pretend to be Google or your bank. Learn more in how to tell if an email is a phishing scam.
Real examples
The stopped hacker. Emma received a Google prompt at midnight asking “Are you trying to sign in?” She tapped No and changed her password. Her password had been leaked in a breach, but 2-Step Verification stopped the attacker.
The phone upgrade. Ryan got a new phone and wiped his old one without moving his authenticator codes. Thanks to backup codes stored in his password manager, he regained access.
The passkey switch. Maria added a passkey to her Google account and now signs in with her fingerprint, no codes needed.
Frequently asked questions
Is 2-Step Verification the same as two-factor authentication?
Yes. 2-Step Verification is Google’s name for two-factor authentication.
Do I need 2-Step Verification every time I sign in?
Usually only on new devices or browsers, or when Google detects unusual activity. You can mark trusted devices.
Can I use Gmail 2FA without a phone?
Yes. Use a security key, passkey on a computer or backup codes.
What if I lose my phone?
Use backup codes, a security key or another trusted device to sign in, then remove the lost phone from your account.
Is Google Authenticator safe?
Yes. It is a widely used authenticator app. Enable backup to your Google account or keep backup codes in case you lose your phone.
Secure the rest of your Google account too
Turning on 2-Step Verification is the biggest step, but a quick security review makes your account even stronger. Google’s Security Checkup at myaccount.google.com/security-checkup walks you through it. Pay attention to these areas:
| Area | What to check | Why it matters |
|---|---|---|
| Recovery phone and email | Up to date and still yours | Lets you recover the account if locked out |
| Your devices | Only devices you recognize | Removes access from lost or old devices |
| Third-party access | Apps connected to your Google account | Old apps may have broad permissions |
| Saved passwords | Google Password Manager warnings | Finds reused or leaked passwords |
| Recent security activity | Sign-ins and changes in the last 28 days | Spots suspicious activity early |
| Gmail settings | Forwarding rules and filters | Attackers sometimes forward your email secretly |
The last item is important and often overlooked. In Gmail on a computer, open Settings, See all settings, Forwarding and POP/IMAP and Filters and Blocked Addresses. If you see forwarding to an address you do not recognize, or filters that delete or archive security emails, remove them immediately and change your password.
Google’s Advanced Protection Program
For people at higher risk of targeted attacks, such as journalists, activists, business leaders, political campaign staff or anyone who has been targeted before, Google offers the Advanced Protection Program. It requires passkeys or security keys for sign-in, limits which apps can access your data and adds extra checks to account recovery. It is free and can be enrolled at Google’s Advanced Protection page.
Turning on 2FA everywhere else
Once Gmail is protected, enable two-factor authentication on your other important accounts in this order:
- Other email accounts such as Outlook, Yahoo or iCloud
- Banking and payment apps, including PayPal and investment accounts
- Apple ID or Microsoft account
- Social media such as Instagram, Facebook, TikTok and X
- Shopping accounts with saved cards, like Amazon
- Work accounts, following your employer’s instructions
- Password manager, which protects all your other passwords
An authenticator app can hold codes for many accounts at once, so setup gets faster after the first few. Combined with a password manager and unique passwords, two-factor authentication blocks the vast majority of account takeover attempts.
How long does setup take?
Turning on 2-Step Verification with Google prompts takes about two minutes. Adding an authenticator app takes another two minutes, creating a passkey about one minute and saving backup codes one more. In under ten minutes, your Gmail account goes from relying on a single password to being protected by multiple strong layers. Few security steps offer that much protection for so little effort, so do it today rather than waiting until after a scare.
The bottom line
To set up two-factor authentication on Gmail, go to myaccount.google.com, open Security, choose 2-Step Verification and follow the steps. Add a strong method like an authenticator app, passkey or security key, save backup codes and keep recovery information up to date. It takes about five minutes and dramatically reduces the risk of your account being hacked. For social media, also see what to do if your Instagram account is hacked.
2 thoughts on “How to Set Up Two-Factor Authentication on Gmail (2-Step Verification)”