Google 2-Step Verification for Beginners: Lock Your Account

Illustration of a laptop showing a password sign-in box beside a phone with a green shield and Yes or No buttons, a padlock, and the title Google 2-Step Verification for Beginners.

Last checked: 11 October 2026. Steps follow Google's own Google Account Help pages on that date. Google does tweak its menus from time to time, so don't worry if yours looks slightly different.

Here's an uncomfortable thought: if someone got hold of your Google password, what could they get into? Your emails, certainly. Your photos, your documents, your calendar. For most of us, that one password is the key to an awful lot.

The good news is that there's a simple setting that means a stolen password on its own isn't enough. It's called 2-Step Verification, and in this guide I'll show you what it is and exactly how to switch it on, on a computer, an Android phone or an iPhone. No jargon, I promise. Well, hardly any.

What is 2-Step Verification?

Google describes 2-Step Verification as "an extra layer of security to your account in case your password is stolen". You might also hear it called two-factor authentication; it's the same idea.

Think of it as a front door with two locks. Your password is the first key. The second step is something only you have, usually your mobile phone. When you sign in, Google checks your password and then asks for that second step, such as tapping Yes on a message that pops up on your phone. Someone who has only stolen your password is stuck on the doorstep.

Once it's on, you'll sign in with your password plus a second step, or with a passkey (more on those later).

Why bother?

Passwords get stolen. Fake emails, dodgy websites and data leaks all happen. This is for the day yours ends up in the wrong hands.
You get a warning. If someone else tries to sign in with your password, the prompt on your phone shows details such as the device and location. You can tap No to block them.
It protects everything at once. Gmail, Drive, Photos and the rest share one Google Account, so one setting protects the lot.
It's mostly painless. On your own computer and phone you can tell Google not to ask every time.

For most people, the second step is simply the phone they already carry. The only extra you might choose to buy is a security key, which I'll explain further down.

Before you start

Have your Google password and your phone handy, as Google may ask you to sign in again.
Have a printer, or pen and paper, ready for your backup codes in Step 3.
If your Google Account comes through work or another organisation, these steps may not work. In that case, Google's advice is to contact the person who runs those accounts.

Step by step: switching it on

The setting itself is the same everywhere. It lives in your Google Account, in a section called Security & sign-in. The only difference between devices is how you get there.

Step 1: Open your Google Account settings

On a computer: open your web browser, go to myaccount.google.com and sign in if asked. Then click Security & sign-in.

On an Android phone: open your phone's Settings app and tap Google. Tap your profile picture or initial, then Manage your Google Account, then Security & sign-in. (Settings apps vary between makes, so look for the word "Google".)

On an iPhone or iPad: open the Gmail app (or another Google app, such as Google Maps). Tap your profile picture or initial in the top right, then Manage your Google Account, then Security & sign-in. If you don't use any Google apps, go to myaccount.google.com in Safari instead.

Shortcut: typing g.co/2sv into your browser takes you straight to Google's own 2-Step Verification set-up page. As always, check you're on a google.com address before entering your password.

Step 2: Turn on 2-Step Verification

In Security & sign-in, look for the heading How you sign in to Google.
Select Turn on 2-Step Verification.
Follow the on-screen steps. Google will guide you through choosing your second step.

That's genuinely it. From then on, Google picks whichever check it thinks is best each time you sign in.

Step 3: Get your backup codes (please don't skip this one)

Backup codes are your spare key. If you lose your phone, change your number or simply can't get a code, a backup code lets you in. Each one is 8 digits long, you get 10 at a time, and each code works only once.

Go back to Security & sign-in.
Under How you sign in to Google, select 2-Step Verification. You may need to sign in again.
Under Backup codes, select Continue, then Get backup codes.
Choose Print codes or Download Codes.

Google suggests keeping a printed copy somewhere safe, "like where you keep your passport or other important documents". A drawer of important papers is far harder for a hacker in another country to reach than a file on your computer.

Which second step should you use?

Google prompts (Google's recommendation)

A message pops up on your phone asking if you're trying to sign in. You tap Yes if it's you and No if it isn't. Google recommends this over typing in codes because it's easier, and because it helps protect against SIM swap scams, where a criminal persuades a mobile network to move your number to their SIM card.

Android: works on Android phones signed in to your Google Account (with Google Play services kept up to date).
iPhone: works if you're signed in to the Gmail, Google Photos, YouTube or Google app.

Sometimes Google may ask for a little more, such as your phone's PIN, or for you to match a number shown on your computer screen with one on your phone.

A code by text message or phone call

Google sends a 6-digit code to a phone number you've given it, by text or voice call, and you type it in. Google points out that codes sent by text or call are more vulnerable to phone number-based hacks than prompts, but any form of 2-Step Verification is better than none. One thing to know: when you add a phone number for 2-Step Verification, it can take up to 7 days for Google to trust it. That delay is deliberate, giving you time to react if someone else added it.

Google Authenticator app

An app (from the Google Play Store on Android or the App Store on iPhone) that creates one-time codes, even when your phone has no signal or internet. To set it up, go to your 2-Step Verification settings and choose Set up authenticator (on some devices it says Get Started), then follow the steps. If you sign in to the app with your Google Account, your codes are synced, so they move across when you get a new phone. As with a new phone number, it can take up to 7 days to appear as a sign-in option.

Passkeys and security keys (the extra-strong options)

A passkey lets you sign in with your fingerprint, face or the PIN you use to unlock your phone or computer. Because a passkey proves you have your device, it skips the second step altogether, and it can't be handed over to a scammer the way a password can. It needs a reasonably recent device, for example Android 9, iOS 16, Windows 10 or macOS Ventura or later. Google's warning is worth repeating: only create a passkey on a device you personally own, because anyone who can unlock that device can get into your account.

A security key is a small gadget you buy and plug in (or tap) to prove it's you. Google sells its own Titan Security Keys, and other compatible keys are available from retailers. For most home users, prompts plus backup codes are plenty.

Handy tips

Tick "Don't ask again" on your own devices. When signing in on your own computer or phone, tick Don't ask again on this computer (or on this device). Never tick it on a shared or library computer.
Set up more than one second step, such as prompts plus backup codes, so you've always got another way in.
Some apps may need you to sign in again after you turn it on. That's normal.
Keep your recovery options up to date. A recovery phone number or email address on your Google Account helps you get back in if you're ever locked out.

Common problems (and what to do)

"The prompt never arrived." On the sign-in screen, choose Resend it. Check your phone is connected to Wi-Fi or mobile data and that Do Not Disturb is switched off. On an iPhone, try opening the Gmail or Google app first.
"I didn't get a text." Google may have sent a prompt instead, so check your phone for a notification. If you asked for several codes, only the newest one works.
"I've lost my phone!" Don't panic. On the sign-in screen choose Try another way and use a backup code, another phone you've added, or a passkey or security key. Then sign the lost phone out of your account and change your password.
"I've run out of backup codes" or "I've lost them." Go back to the backup codes page and create a new set. The old set stops working automatically.
"I'm completely locked out." Use Google's account recovery and answer the questions as best you can. Because of the extra security, Google says this can take 3 to 5 business days, which is the best reason I know for keeping those backup codes safe.

Staying safe: the golden rules

Never share a code with anyone. Not a verification code, not a backup code. Google says it will never phone you to verify a code, and never asks for a backup code except when you're signing in.
If someone calls asking for "the code we just sent you", hang up. However official they sound.
A prompt you weren't expecting? Tap No. Someone may have your password, so change it straight away.
Keep backup codes on paper, somewhere safe, not in an email or a shared document.

Frequently asked questions

Will I have to do this every time I check my email?

No. On your own computer or phone you can tick "Don't ask again", and Google will only ask again in certain cases, such as signing in somewhere new.

What if I don't have a smartphone?

You can still use it. Codes can be sent by text message or voice call to an ordinary mobile, and backup codes work without any phone at all.

Can I turn it off again?

Yes, from the same 2-Step Verification page, using Turn off. Google warns this makes your account easier for someone else to get into, so I'd leave it on.

I've heard about passkeys. Do I still need 2-Step Verification?

They work together. Turning on 2-Step Verification protects you whenever you sign in with a password, and a passkey is simply a quicker, safer way in that skips the second step because it proves you have your device.

Final thoughts

If you only change one setting this year, make it this one. It doesn't take long, and it turns your Google Account from a front door with one lock into one with two. Switch it on, print your backup codes, pop them in the drawer with the passport, and relax knowing a stolen password alone won't get anyone in.

If you get stuck, leave a comment below and I'll do my best to help, but never post codes or personal details in a comment.

Search This Blog

Tech Ramblings of a 50 Something