Google 2-Step Verification: how to set it up safely
Quick answer
Turn on 2-Step Verification at myaccount.google.com/security. Google then asks for a second step when you sign in somewhere new. The strongest options are passkeys and security keys, followed by Google prompts on your phone and authenticator codes. SMS codes are the weakest because of SIM swaps and recycled numbers. Add at least two methods and print backup codes. Never use a temporary number as your only Google recovery phone.
Your Google account often unlocks your email, photos, payments and every other account that resets through Gmail. 2-Step Verification is the single most useful protection you can add to it.
Turning it on
- Go to myaccount.google.com, then Security.
- Choose 2-Step Verification and follow the steps.
- Add a second method and download backup codes before you finish.
Which second step to pick
| Method | Strength | Notes |
|---|---|---|
| Passkey or security key | Strongest | Resists phishing |
| Google prompt | Strong | Tap Yes on a signed-in phone |
| Authenticator app | Strong | Works offline |
| SMS or voice code | Weakest | Vulnerable to SIM swap and number recycling |
| Backup codes | Emergency | Print and store them |
Phone number advice
If you verified the account with a temporary Noir SMS number, replace it with your own number or remove it once 2-Step Verification is set up with a prompt, authenticator or passkey. A recycled number in the recovery field is a risk.
Frequently asked questions
Can I use 2-Step Verification without a phone number?
Yes, with a security key or passkey plus backup codes, though Google may ask for a phone during setup.
What if I lose my phone?
Use a backup code or another method you added, then remove the lost phone from your account.
Services in this guide
Keep reading
Two-Factor Authentication Explained: SMS, Authenticator Apps, Passkeys and Security Keys
2FA explained: SMS codes, authenticator apps, passkeys and hardware security keys compared, with clear recommendations for your accounts.
Read the guide →Safety & privacyHow to Move Two-Factor Authentication Off a Temporary Number
Step-by-step: switch an account's sign-in and recovery from a temporary number to an authenticator app, passkey, email or your own number.
Read the guide →Safety & privacySIM Swap Protection: What SIM Swapping Is and How to Stop It
What SIM swapping is, warning signs, and how to protect your accounts with a carrier PIN, port-out lock and 2FA that doesn't rely on SMS.
Read the guide →Safety & privacyHow to Protect Your Phone Number From Spam, Data Brokers and SIM Swaps
Your phone number links to spam, data brokers, SIM-swap attacks and account takeover. Practical steps to protect it, and where a temporary number helps.
Read the guide →Safety & privacyWhat Is SMS Verification? How OTP Codes Work and Safer Alternatives
What SMS verification and one-time passcodes are, why sites use them, how codes are delivered, and how SMS 2FA compares to authenticator apps and passkeys.
Read the guide →Safety & privacyIs It Safe to Use a Virtual or Temporary Phone Number?
Are temporary and virtual numbers safe for verification? The real risks (recycling, recovery, public inboxes) and how to use one safely.
Read the guide →