Turn on Google 2-Step Verification

You may have signed in to your bank on a computer and been asked for a code that arrived on your phone by text message. If so, you have already used a second step. The password was the first step, and the code sent to your phone was the second step. Google can also ask for a second step when you sign in to your Google Account. The setting is called 2-Step Verification. After your password, Google asks for a second proof that the person signing in is you, and that second proof is usually a tap on your phone.

Your Google Account is the account you sign in to for Gmail and Google Photos, and for every website where you chose Sign in with Google. If you cannot sign in to Gmail, to Google Photos or to one of those websites, you get back in through your Google Account. Passwords get stolen in breaches. A breach is when thieves copy a company's records, including its customers' passwords, and pass the copy around. A password that is in one of those copies is not a secret any more. A scammer who holds the copy can sign in as you and reach your Gmail, your Google Photos and every website where you chose Sign in with Google. With 2-Step Verification on, a password copied from a breach is not enough on its own, because the scammer does not have your phone.

Google also gives you backup codes. Backup codes are codes that stand in for the second step when your phone cannot do it. Backup codes are like a spare key: each one opens the door once. Without your phone or a backup code, your family may not get past the second step. Backup codes printed on paper are not stored inside the account the codes open. The paper goes with your will and estate documents; estate documents are the papers that say what happens to what you own.

Before you start

• About fifteen minutes.
• A computer and the phone that is signed in to your Google Account. The second step usually arrives on the phone.
• Your Google Account password.
• A printer. If you keep the master password for a password manager on a paper sheet, the backup codes belong on that sheet. A master password is the one password that opens a password manager.
• The folder where your will and estate documents are kept.

Turn on 2-Step Verification and print the backup codes

Google offers several kinds of second step, including a Google prompt, an authenticator app and a code sent by text message or phone call. A Google prompt is a message Google shows on your phone when someone signs in, and you answer it with a tap. An authenticator app is an app on your phone that shows sign-in codes. A code sent by text or call goes to your phone number, and your phone number lives on your SIM card, the small card inside your phone. A scammer can get your phone number moved to a SIM card in a phone the scammer holds, and that SIM card is then called a swapped SIM. Codes sent by text or call can be caught by a swapped SIM, and the Google prompt holds up better against a swapped SIM.

1. Open your Google Account. On the computer, go to myaccount.google.com. Sign in with your Google Account password.
2. Open the security page. On the left side of the screen, find Security & sign-in and click it. On some screens this entry is called Security instead.
3. Turn on 2-Step Verification. Find the heading How you sign in to Google. Under that heading, find 2-Step Verification. Next to 2-Step Verification, find Turn on and click it. Then follow the steps Google shows on the screen. Where you can, choose the Google prompt or an authenticator app. Google's page, as we read it, says only to follow the on-screen steps and does not list those screens, so we cannot say what each one shows.
4. Get the backup codes. Go back to the Security & sign-in page. Find 2-Step Verification and click it. Find the heading Backup codes. Under that heading, find Continue and click it. Then find Get backup codes and click it. Google gives you ten codes. Each code is eight digits long and works once.
5. Print the codes. Find Print codes and click it. Put the paper with your will and estate documents. A screenshot, a picture of your screen saved on the phone, is not a backup, because the screenshot lives inside the account the codes are for.
6. Check that it worked. On the computer, sign out of your Google Account, then sign back in. After the password, Google should ask for the second step.

What this does not do

• 2-Step Verification does not stop a scammer who talks you into reading a code aloud. Google will never call you to ask for a code.
• Refresh gives you a new set of codes. The moment you click Refresh, every code in the old set stops working, so print the new set when you do.
• A phone number you have just added to the account can take up to seven days before Google trusts it.
• If your Google Account is enrolled in Google's Advanced Protection Program, backup codes cannot be downloaded. The Advanced Protection Program is a separate Google program, and this page does not cover it.
• This setting covers one account. Your Apple Account, your bank and your phone company each need a second step of their own.

If your screen looks different

On an Android phone, you reach the security page from the Settings app. Android is the phone software made by Google; most phones that are not iPhones run Android. Open the Settings app. Find Google and tap it. Find Manage your Google Account and tap it. Find Security and tap it. Google's page for a phone, as we read it, stops at Security, so we cannot say what to tap next. A work or school Google Account may be managed by an administrator, a person at the workplace or school who controls the account. These steps might not work on a work or school account. If the names on this page are not on your screen, search for 2-Step Verification in the search box at the top of the Google Account page.

Sources

• Google: Turn on 2-Step Verification (Computer), read on 18 October 2026.
• Google: Sign in with backup codes (Computer), read on 18 October 2026.