Set Up Two-Factor Authentication on Gmail

Before You Start

Have your Gmail address, current Google Account password, and a device that is already signed in if possible. You must be able to confirm your identity before changing security settings.

You also need at least one verification method that you can use now. Depending on what Google offers for your account and device, this may be a Google prompt, a phone that can receive a code, an authenticator app, a passkey, or a physical security key.

Use a private device with a secure screen lock. Do not start on a shared computer unless you can sign out completely afterward. If this is a work or school account, the organization’s administrator may control Two-Step Verification.

Open Your Google Account Security Settings

From Gmail, select your profile picture or initial in the upper-right corner. Choose Manage your Google Account, then open Security & sign-in. On a narrow phone screen, you may need to swipe across the account tabs or open the navigation menu to find it.

You can also begin at Google’s official account sign-in page. Sign in, open your Google Account, and select Security & sign-in. Under How you sign in to Google, look for Two-Step Verification or Turn on 2-Step Verification.

Check that the Gmail address shown at the top is the account you intend to protect. People with several Google accounts sometimes change the wrong account’s settings.

Turn On Two-Step Verification

Google calls its two-factor authentication feature Two-Step Verification. The exact prompts can vary by device and by the methods already connected to your account.

1. In Security & sign-in, find How you sign in to Google.
2. Select Turn on 2-Step Verification. If the page instead shows Two-Step Verification, select it and follow the option to begin setup.
3. Enter your password or complete the identity check Google presents.
4. Review the available second-step methods. Choose one that you control and can reach immediately.
5. Follow the on-screen instructions. This may involve approving a Google prompt, entering a newly received code, unlocking a device, or confirming a security key.
6. Review the result and complete the final Turn on or confirmation step if Google displays one.

This is the official process for how to set up two factor authentication Gmail users need. Searches such as how to set up two factor authentication on Gmail, how to setup two factor authentication Gmail, and how to setup two factor authentication on Gmail all refer to this same Google Account setting.

Never approve a prompt or provide a code unless you initiated the sign-in or settings change yourself. A verification code is temporary and should not be shared.

Choose a Backup Verification Method

Do not depend on only one phone or one device. While you still have access, return to Two-Step Verification and add a backup method offered for your account.

• Backup codes are one-time codes for use when the normal second step is unavailable. Save them somewhere secure and separate from your phone. Each code stops working after it is used, and creating a new set invalidates the old set.
• Google Authenticator can generate verification codes without mobile service or an internet connection after it has been configured. Follow the setup instructions in the Two-Step Verification area and confirm that a generated code works.
• A physical security key can verify possession of a separate device. Register it through the account security settings and keep a backup method available.
• A passkey uses a device unlock method, such as a PIN, fingerprint, or face check. Create passkeys only on devices you personally control. A passkey can verify possession of the device and may replace the password-and-second-step flow during sign-in.
• A backup phone or another signed-in phone may appear as an option. Keep the associated information current.

Available choices can differ by account, device, and organization policy. Use the methods shown in your own Google Account rather than instructions from an unsolicited message.

Confirm That Protection Is Active

Return to Security & sign-in and open Two-Step Verification. Confirm that it is shown as on and that your intended verification methods appear. Review them without displaying backup codes where another person can see the screen.

To test the setup safely, use a private browser window or another device you control. Start a normal Gmail sign-in and enter your own credentials directly. If Google requests the configured second step, complete it and confirm that Gmail opens.

Do not remove working methods just to force a test. Do not sign out of every trusted device until you know that at least one second step and one backup option work. Close the private window after testing.

Fix Setup and Sign-In Problems

If a prompt is missing, confirm that the phone is online, signed in to the correct Google Account, and able to receive notifications. Open the Google or Gmail app directly and check for a waiting prompt. You can also select Try another way during sign-in to see methods already connected to the account.

If a text or other code does not arrive, wait for the current attempt to finish before requesting another. When several codes are requested, only the newest may work. Check that you entered the code for the correct account and that it has not already expired or been used.

For an invalid authenticator code, confirm that the phone’s date and time are set automatically and that you selected the correct account entry. Use a fresh code after it changes. If the phone is unavailable, choose Try another way and use a saved backup code, another signed-in phone, a registered security key, a passkey on another device, or another option Google displays.

If a device was lost but you can still sign in elsewhere, open the Google Account security settings. Remove the lost device’s passkey or security method, review signed-in devices, and add a replacement verification method. Generate new backup codes if the saved set was lost or exposed.

If none of the listed methods is available, use Google’s official Account Recovery option from its sign-in help. Answer the questions as accurately as possible, preferably from a familiar device and location. Google determines which checks to present; do not rely on third-party recovery services or anyone asking for your password or verification code.