Google’s sign-in methods differ in phishing resistance, device requirements, and recovery behavior. Choose a strong primary method and a practical independent backup rather than treating every six-digit code or phone notification as equivalent.
Google prompts
A prompt asks you to confirm a request on an eligible signed-in phone. It provides context such as the device and location. Google recommends prompts over SMS when a passkey is not being used.
The phone needs an internet connection and the appropriate signed-in account. Reject unexpected requests; tapping Yes simply to stop repeated notifications can authorize somebody else’s attempt.
Authenticator codes
An authenticator app generates time-based one-time codes after enrollment. Google Authenticator can generate them without mobile service or internet access.
These codes are still secrets that a phishing page can ask you to enter. Protect the app and its enrollment or transfer QR codes, and plan how to retain access when changing phones.
SMS and voice codes
Where offered, Google sends a code to a previously supplied number. Delivery depends on the device, provider, location, and Google’s assessment of the request.
These methods can be vulnerable to phone-number-based attacks. Owning a number also does not guarantee that SMS is offered for every challenge.
Hardware security keys and passkeys
A hardware security key is a physical authentication device registered to the account. A compatible FIDO2 key can also hold a passkey. Device-based passkeys can use the phone or computer’s screen lock, fingerprint, or face unlock.
Google describes passkeys and hardware keys as protection against phishing. A passkey can complete sign-in without a separate second-step code. Create it only on a device you control, because somebody who can unlock that device may be able to use it.
Backup codes
Backup codes are pre-generated, single-use alternatives for supported accounts. Keep them securely somewhere available independently of the primary phone. They are not daily rotating Authenticator codes and should never be shared with a helper.
Availability depends on account type and policy; Advanced Protection has different restrictions. Before replacing a phone or key, confirm that another enrolled method is ready. A method merely appearing in a general help article does not prove it is available or already trusted on your account.
Official references
- Turn on 2-Step Verification
- Get verification codes with Google Authenticator
- Use a security key for 2-Step Verification
- Sign in with a passkey instead of a password
- Sign in with backup codes
Reviewed against Google’s official guidance on October 27, 2026. Available options and screen labels can vary by account, device, region, and organization policy.