Google 2-Step Verification adds protection when a password is stolen. Set it up while you still have reliable account access, and prepare a backup that will not disappear with the same phone.
Start in the intended account
- Open Google Account and confirm the complete address.
- Select Security & sign-in.
- Under How you sign in to Google, select the option to turn on 2-Step Verification.
- Complete the setup and verification shown.
- Return to the settings to confirm that protection is enabled.
Work or school policies may control setup and permitted methods. Ask the administrator if the option is unavailable rather than trying to evade organization requirements.
Choose a suitable method
Google supports several methods, including prompts, Authenticator codes, hardware security keys, and text or call codes where offered. Passkeys provide a different sign-in experience: Google says a passkey can satisfy the verification without a separate password-plus-code sequence.
Google recommends prompts over SMS when not using a passkey and identifies passkeys and hardware keys as stronger protection against phishing. Choose methods that fit your devices and accessibility needs while keeping recovery practical.
Add an independent backup
Consider a second enrolled device or key, or securely stored backup codes if your account supports them. Google backup codes are single-use, and generating a new set invalidates the previous set.
Do not keep your only backup inside the same locked account or only on the phone you are trying to protect against losing. Confirm that you can locate and use the backup without approving an unexpected request.
Account for activation delays
A newly added phone number or authentication method may require a trust period. Google’s current guide says a new 2-Step Verification phone number can take up to seven days to become trusted. Read the account’s actual status before removing an older working option.
Use prompts and codes deliberately
Approve only sign-ins you initiated, and enter codes only into the legitimate sign-in flow. Do not read them to a caller claiming to be Google.
After setup, review recovery information too. A recovery phone and a 2-Step Verification number serve related but distinct purposes; adding one does not establish that every other security setting has been updated.
Official references
Reviewed against Google’s official guidance on October 27, 2026. Available options and screen labels can vary by account, device, region, and organization policy.