How to Turn On 2-Step Verification for a Google Account

A password is not the only way to protect a Google Account. With 2-Step Verification turned on, signing in also requires a second check, such as a prompt on a phone or a code from an authenticator app. That extra step can help protect an account if someone learns its password.

This beginner-friendly guide walks through turning on the setting, choosing a second step, and preparing a backup. Google’s menus can change, so the labels may look slightly different on your device.

Before you begin

Have your Google Account password handy and use a device you trust. If you can, make sure your recovery phone number and email address are current. Those recovery options can help if you lose access, but they are not a replacement for setting up a second sign-in method.

Think about what you would do if your phone were lost, damaged, or unavailable. A backup method matters: otherwise, a security step meant to protect your account could also make it harder for you to get back in.

Steps to turn on 2-Step Verification

1. Open your Google Account settings. On a computer or phone browser, go to myaccount.google.com and sign in to the account you want to protect.
2. Open the security settings. Select Security or Security & sign-in. Find the section about how you sign in to Google.
3. Choose 2-Step Verification. Select the option and follow the on-screen prompts. Google may ask you to sign in again to confirm it is you.
4. Review the suggested second step. Google may offer a prompt on a phone already signed in to your account. Read the instructions and confirm that the device shown is yours and accessible to you.
5. Choose or add a method you can use. Depending on your account and device, you may be able to use a Google prompt, an authenticator app, a security key, or a phone number for a code. Follow the setup instructions for the method you select. If you use a phone number, enter the number you control and complete the verification Google requests.
6. Finish enabling the feature. Complete any confirmation step and check the account’s security page to make sure 2-Step Verification is shown as on.
7. Add a backup option. If the security page offers backup codes, generate them and keep them somewhere private and separate from your phone. You can also add another suitable sign-in method if Google offers it. Treat each backup code like a one-time password: do not post it, send it to someone who contacts you, or leave it where other people can find it.
8. Test your plan before relying on it. Sign out only if you are sure you can sign back in, then try a normal sign-in using a device you trust. Confirm you know where the prompt or code will arrive and how you will use your backup option. Do not test by removing your only working sign-in method.

Which second step should you choose?

There is no single method that suits everyone. A phone prompt can be convenient if you regularly have your trusted phone nearby. An authenticator app generates codes on a device, while a security key is a physical device you use when prompted. Availability and setup can vary by account and device. Follow Google’s current instructions for the choice you make.

If you cannot use a more convenient method, a text message may be an option. Make sure the number is yours and can receive messages. Whatever you choose, keep your recovery information current and arrange a backup in case your usual device is unavailable. CISA advises people to use multifactor authentication where it is offered; a second check adds a barrier beyond the password alone.

Things to know

• A prompt or code is not permission to approve a surprise sign-in. If you get a request you did not initiate, do not approve it. Review the account’s security activity from your own Google Account settings.
• Never share verification codes. A caller or message claiming to be support should not need you to read out a code. Enter codes only into the sign-in flow you started.
• Keep backup codes private. Store them in a secure place you can reach if your phone is missing. Do not save them only on the same phone they are meant to help replace.
• Plan before changing phones or numbers. Add and test another sign-in method before giving up access to the old one. If you have already lost your second step, use Google’s account recovery process rather than a link from an unsolicited message.
• Some devices or apps may ask you to sign in again. Follow the official sign-in prompts. Avoid switching off 2-Step Verification just to bypass a request you do not understand.

A small setup worth checking

Turning on 2-Step Verification is only part of the job: choosing a method you can reliably access and preparing a private backup make the setting more useful. Take a moment to review your recovery details, then keep an eye on Google’s security settings as your devices or contact information change.