Short answer: To set up 2FA on your Google account, go to myaccount.google.com/security, select 2-Step Verification, and follow the prompts. Google will start you on phone prompts or SMS — but you should immediately add an authenticator app or a passkey as your primary method and remove SMS afterwards. The whole process takes about ten minutes.
This is the single most important account to protect. Your Google account can reset the password on almost everything else you own, which makes it the master key to your digital life.
Step 1: Turn on 2-Step Verification
- Sign in and open myaccount.google.com/security.
- Under “How you sign in to Google,” click 2-Step Verification.
- Click Get started and re-enter your password.
- Google will offer phone prompts on devices you are already signed into. Accept this to get the switch flipped — you will improve it in a moment.
- Enter a phone number for the initial verification and confirm the code.
2-Step Verification is now active. It is not yet configured well, but the account is no longer password-only, which is the biggest single jump in security you will make.
Step 2: Add an authenticator app
Back on the 2-Step Verification page, scroll to Authenticator and click Set up authenticator.
- Google displays a QR code, along with a setup key for manual entry if you cannot scan it.
- Open your authenticator app and choose to add an account by scanning a code.
- Scan the QR code, then type the six digits your app shows back into Google.
Do not screenshot that QR code. It contains your raw secret key, and anyone who obtains the image can generate your codes indefinitely. If you want a redundant backup, scan the same code into a second app now, while it is still on screen — Google will not show it again.
Not sure which app to use? Our Authy vs Google Authenticator comparison covers the trade-offs, and there is a wider roundup of authenticator apps if you want desktop access or open-source code.
Step 3: Save your backup codes
On the same page, find Backup codes and click Get backup codes. Google issues ten single-use codes. Each one substitutes for an authenticator code exactly once.
Store them somewhere your phone is not — printed and filed at home, or in an encrypted password manager. Do not leave them in a plain notes app, an email draft, or your camera roll.
These codes are what stand between you and a multi-day account recovery process if your phone disappears. Our guide on recovering accounts after losing a phone explains why this step matters more than any other on this page.
Step 4: Add a passkey (strongly recommended)
On the Security page, select Passkeys and security keys and create a passkey on your phone or laptop.
A passkey is bound to google.com specifically, so a fake login page cannot use it — which makes it the only method on this list that resists phishing outright. Authenticator codes can still be typed into the wrong site by mistake. We compare the two approaches in passkeys vs 2FA.
If you want the strongest option available, register a physical security key such as a YubiKey instead. Register two and store one somewhere safe.
Step 5: Remove SMS
This is the step almost everyone skips, and it undoes much of the work above.
If SMS remains enabled as a recovery option, an attacker can hijack your phone number through a SIM swap and use that weaker path — your authenticator app is simply bypassed. Your security is set by the weakest method you leave switched on.
On the 2-Step Verification page, find your phone number under voice or text message and remove it. Google will only allow this once you have another second factor configured, which you now do.
While you are at it, call your mobile carrier and ask them to add a port-out PIN to your account. It takes five minutes and it is the most effective single defence against SIM swapping. Our SMS vs authenticator app breakdown explains the attack in full.
Step 6: Audit what else has access
Two more things worth doing while you are in Security settings:
- Your devices — review every signed-in device and sign out anything you do not recognise or no longer own.
- Third-party access — revoke apps and services you no longer use. Old integrations with broad permissions are a common overlooked entry point.
- Recovery email and phone — make sure these are current and that the recovery email is itself protected with 2FA.
Frequently asked questions
Is Google 2-Step Verification the same as 2FA?
Yes. “2-Step Verification” is simply Google’s branding for two-factor authentication. The concept and the protection are identical.
Will 2FA lock me out if I lose my phone?
Only if you have no other method. With backup codes saved offline, or a passkey on a second device, you can still get in. This is why steps 3 and 4 matter.
Can I use Google 2FA without a phone number?
Yes. Once an authenticator app or passkey is registered, you can remove the phone number entirely. Google requires a phone only during the initial setup flow.
Does 2FA apply to Gmail specifically?
It applies to your entire Google account — Gmail, Drive, Photos, YouTube, and every service you sign into with Google. There is no separate Gmail setting.
What if my authenticator codes stop working?
Almost always a clock problem. Enable automatic network time in your phone’s date and time settings. TOTP codes depend on your device’s clock matching Google’s within about 30 seconds.
Should I use phone prompts instead of an app?
Google prompts are convenient and reasonably secure, especially with number matching. But they need internet access and they train you to approve pop-ups — a habit attackers exploit with prompt-bombing. An app or passkey is the better primary method.
The bottom line
Turning on 2-Step Verification takes two minutes. Configuring it properly — app, passkey, offline backup codes, SMS removed — takes ten and is what actually protects you. Do all six steps in one sitting, because the half-finished version leaves the door you meant to close still open.
7 Responses