Two-step verification: what it is and how to turn it on in Gmail, in 5 minutes
It's the extra lock that stops thieves even when they have your password. Explained from scratch, with the exact steps to turn it on for your Google account.
- Level
- beginner
- Time
- 5 minutes
- What you need
- The phone you use Gmail on
Picture your front door with two locks: someone who steals the key to the first one is still stuck outside. Two-step verification does the same thing for your accounts, because besides the password it asks for a confirmation on your phone. A scammer who has found out your password, but doesn’t have your phone, stays outside. One route is left to them, which is talking you into confirming on their behalf. So approve the confirmation only when you are the one, right then, signing in to the account.
Two-step verification (also called "two-factor authentication" or "2FA"): after the password, the site asks for a second proof that it's you, usually a tap on a notification on your phone or a 6-digit code. Account: your "place" on a service, for example your Gmail mailbox.
Why start with Gmail
Your mailbox is the key to everything, because with “forgot password” you can reset the password of any other site. Whoever gets into your email gets in everywhere. So it’s the one you protect first. The same instructions apply, with small differences, to Outlook, Apple, Facebook, Instagram and your bank.
How to turn it on for your Google account
- Open your browser (Chrome or Safari) and go to
myaccount.google.com. If it asks you to sign in, enter your Gmail address and password. - In the menu on the left (on a phone: swipe the tabs at the top) tap Security.
- Scroll to the section "How you sign in to Google" and tap 2-Step Verification. It may ask for your password again, which is normal.
- Tap Turn on 2-Step Verification and follow what Google offers you. If it offers a passkey, that's the best choice, and bear in mind a passkey takes the password's place rather than being a second code. If it suggests notifications on your phone ("Google prompt"), those are fine too, tap Continue.
- If it offers to add a backup phone number, you can skip it: it isn't required, and a number left on the account stays an entrance via SMS. The backup codes in the next step are a better safety net.
- Tap Turn on. Done. From now on, when you sign in from a new device, a notification "Are you trying to sign in?" appears on your phone and you tap Yes.
It won't ask for confirmation every time. On the phone and computer you normally use you stay signed in as before. The confirmation only comes when someone (you or a stranger) tries to get in from a device it has never seen.
Save your emergency codes
On the same page, a little further down, you’ll find Backup codes. Tap “Show codes” and print them, or write them on a sheet of paper to keep at home. They’re 10 single-use codes that let you in if you lose or break your phone. This is the step nearly everybody skips, and then regrets. Do it now, while you’re there.
If you get a notification you didn’t ask for
It means someone has your password and is trying to get in. Tap No, it’s not me, then change the password following the method from this column. Meanwhile the extra lock has done its job.