Two-step verification: what it is and how to turn it on in Gmail, in 5 minutes
It's the extra lock that stops thieves even when they have your password. Explained from scratch, with the exact steps to turn it on for your Google account.
- Level
- beginner
- Time
- 5 minutes
- What you need
- The phone you use Gmail on
Imagine your front door with two locks: someone who steals the key to the first one still stays outside. Two-step verification does this for your accounts: besides the password, it asks for a confirmation on your phone. A scammer who has found out your password, but doesn’t have your phone, doesn’t get in.
Two-step verification (also called "two-factor authentication" or "2FA"): after the password, the site asks for a second proof that it's you, usually a tap on a notification on your phone or a 6-digit code. Account: your "place" on a service, for example your Gmail mailbox.
Why start with Gmail
Your mailbox is the key to everything: with “forgot password” you can reset the password of any other site. Whoever gets into your email can get in everywhere. That’s why it gets protected first. The same instructions apply, with small differences, to Outlook, Apple, Facebook, Instagram and your bank.
How to turn it on for your Google account
- Open your browser (Chrome or Safari) and go to
myaccount.google.com. If it asks you to sign in, enter your Gmail address and password. - In the menu on the left (on a phone: swipe the tabs at the top) tap Security.
- Scroll to the section "How you sign in to Google" and tap 2-Step Verification. It may ask for your password again: that's normal.
- Tap Turn on 2-Step Verification. Google suggests using notifications on your phone ("Google prompt"): that's fine, tap Continue.
- It asks for a backup phone number. Enter it: it's only used if you lose your phone.
- Tap Turn on. Done. From now on, when you sign in from a new device, a notification "Are you trying to sign in?" appears on your phone and you tap Yes.
It won't ask for confirmation every time. On the phone and computer you normally use you stay signed in as before. The confirmation only comes when someone (you or a stranger) tries to get in from a device it has never seen.
Save your emergency codes
On the same page, a little further down, you’ll find Backup codes. Tap “Show codes” and print them or write them on a sheet of paper to keep at home. They are 10 single-use codes that let you in if you lose or break your phone. This is the step everyone skips and everyone regrets.
If you get a notification you didn’t ask for
It means someone has your password and is trying to get in. Tap No, it’s not me, then change the password following the method from this column. The extra lock has just done its job.