How to Turn On 2-Step Verification for Your Google Account

Your Google Account is rarely just an email inbox. It is usually the key to Gmail, Google Drive, Google Photos, YouTube, saved passwords in Chrome, your Android phone backups, and the "Sign in with Google" button on dozens of other sites. If someone gets into it, they often get into everything connected to it. That is why 2-Step Verification (Google's name for two-factor authentication) is one of the most worthwhile security settings you can turn on.

This guide walks through the whole process: what you need before you start, how to enable it, which second step to choose, how to set up an authenticator app (including the manual key option when you cannot scan a QR code), and what to do if something goes wrong.

Why 2-Step Verification matters for a Google Account

A password alone is a single point of failure. Passwords get reused across sites, leak in data breaches, and get typed into convincing phishing pages. With 2-Step Verification on, a stolen password is no longer enough. The attacker also needs your second factor: your phone, an authenticator code, a passkey, or a physical security key.

Before you start: what you need

• Your current password. Google will ask you to sign in again before changing security settings.
• A phone you control. Either a smartphone for prompts and authenticator apps, or a phone number that can receive texts or calls.
• An authenticator app (recommended). Google Authenticator, Microsoft Authenticator, and other standard TOTP apps all work.
• A safe place for backup codes. A password manager, an encrypted note, or a printed sheet stored somewhere secure.
• Correct time on your phone. Authenticator codes depend on the clock, so automatic date and time should be turned on.

How to turn on 2-Step Verification, step by step

Google updates its account pages fairly often, so menu names may vary slightly by version. The overall path has stayed consistent for years.

1. Go to myaccount.google.com and sign in.
2. Open the Security section (in some versions it is labelled "Security & sign-in").
3. Find 2-Step Verification under the section about how you sign in to Google, and select it.
4. Select Get started or Turn on, and confirm your password if asked.
5. Follow the prompts to add a second step. Google may suggest a phone number or Google prompts first; you can add other methods afterward.
6. Confirm the final screen to switch 2-Step Verification on.

Once it is on, return to the same 2-Step Verification page. This is where you manage all your second steps, and it is worth adding more than one so you are never stuck with a single method.

Choosing your second step

Google supports several second factors. They are not equally strong, and the best setup usually combines two or three.

A practical combination for most people: a passkey or Google prompts for everyday sign-ins, an authenticator app as a solid fallback, and backup codes stored safely for emergencies.

Setting up an authenticator app

On the 2-Step Verification page, look for the Authenticator option (sometimes labelled "Authenticator app") and choose to set it up.

1. Google shows a QR code on screen.
2. Open your authenticator app, tap the button to add an account, and scan the QR code.
3. The app starts showing a 6-digit code for your Google Account.
4. Type the current code into Google to confirm the setup.

The "Can't scan it?" option

If you are setting this up on the same phone that would do the scanning, or your camera will not focus on the screen, look for a link such as Can't scan it? below the QR code. Google then shows the setup key as text: a string of letters and digits, usually displayed in groups.

In your authenticator app, choose the option to enter a key manually, type a name for the account, paste or type the key, and make sure the type is set to time-based. Spaces in the key do not matter; most apps ignore them.

This text key is the secret that generates every future code. Treat it like a password. If you choose to keep a copy so you can restore codes on a new phone, store it encrypted, not in a screenshot sitting in your camera roll. You can paste a key into the 2FA-Auth code generator to check that it produces the same 6-digit code as your app, which is a quick way to confirm you copied it correctly.

Save your backup codes

On the 2-Step Verification page, find Backup codes and generate a set. Google gives you a list of single-use codes. Each one works once, and generating a new set cancels the old one.

• Download or print them, then store them away from your phone. If your phone is lost, codes stored only on that phone are lost with it.
• A password manager entry or a printed copy in a drawer at home both work well.
• Cross off each code when you use it, and generate a fresh set when you are running low.

Passkeys and security keys

Google also lets you sign in with a passkey stored on your phone or computer, or with a physical security key that plugs into USB or connects over NFC. These methods are tied to the real Google domain, so a fake login page cannot capture and reuse them the way it could capture a typed code. If you are a frequent target, such as an administrator, journalist, or someone handling money, adding a security key is a strong upgrade.

You can add passkeys from the Security page under the passkeys section, and security keys from the 2-Step Verification page. Register at least two security keys if you go that route, and keep the spare somewhere safe.

What changes after you turn it on

• New devices ask for a second step. On devices you have already confirmed, you can tick an option like "Don't ask again on this device" so you are not prompted every time.
• Some older apps may stop signing in. Older mail clients or devices that do not support modern Google sign-in may need an app password, if that option is available for your account, or an updated app.
• You get more security alerts. Google notifies you about new sign-ins and changes to your security settings. Do not ignore them.
• Recovery depends on your preparation. Keep your recovery email and phone number current in the Security section.

Troubleshooting common problems

The authenticator code is rejected

The most common cause is the phone clock being off. Authenticator codes are calculated from the current time, so even a minute or two of drift can make codes fail. Turn on automatic date and time in your phone settings and try again with a fresh code. Also check you are reading the code for the right account if you have several Google entries in the app.

You got a new phone

Before wiping the old phone, move your authenticator entries. Many apps have an export or transfer feature, and Google Authenticator can sync codes to your Google Account if you enable it. Alternatively, go to the 2-Step Verification page, choose to change your authenticator app, and scan a new QR code with the new phone. The old codes stop working once you do this.

You lost your phone

Sign in using a backup code, a security key, or another method you added. Then go to the 2-Step Verification page, remove the lost phone from your signed-in devices, and set up the authenticator again on your new device.

You have no working second step at all

Use Google's account recovery flow from the sign-in page and answer as accurately as you can, ideally from a device and location you have used before. Recovery can take time. This situation is exactly why adding several methods and saving backup codes matters.

FAQ

Is SMS good enough for 2-Step Verification?

It is much better than a password alone, but text messages can be redirected through SIM swapping. If you can, use an authenticator app, Google prompts, or a passkey as your main method and keep SMS only as a fallback.

Can I use the same authenticator app for other accounts?

Yes. Authenticator apps follow the standard TOTP method, so one app can hold codes for Google, social networks, email providers, and most other services that support authenticator apps.

What happens if I turn 2-Step Verification off?

Your account goes back to relying on the password alone. Google also removes some protections tied to it. If you only need to change methods, edit them on the 2-Step Verification page instead of turning the whole feature off.

Do I need to enter a code every time I sign in?

No. On trusted devices you can choose not to be asked again. You will be prompted on new devices, after clearing cookies, or when Google sees something unusual about a sign-in.