Your Gmail password protects far more than email: the same Google account holds your YouTube channel, Google Photos, Drive files, saved passwords and often your password-reset route for Facebook and banking. Two-step verification (2SV) adds one extra proof — a prompt or code on your phone — so a stolen password alone becomes useless. Setting it up takes about five minutes.
1. Open the Google Account security page
On your phone or PC, go to myaccount.google.com, sign in, and open the Security section. Under "How you sign in to Google" you will find 2-Step Verification. Tap it and choose Get started. Google will ask for your password once more — this is normal.
2. Choose Google prompts as your main method
Google first offers to send a prompt to phones where you are signed in. Tap Try it now / Yes on the prompt that appears on your phone. Prompts are the best default: no code to type, and a thief pressing "Yes" is impossible without your unlocked phone in hand. If you do not see a prompt, make sure the phone is online and signed in to the same account.
3. Add a backup method — do not skip this
Next, add a fallback: text message or voice call codes to your own mobile number. This matters the day your phone is lost, reset, or signed out. Enter your number, receive one code, confirm it works, and finish. Never use someone else's number — account recovery depends on this number being yours and active.
4. Save your backup codes somewhere safe
Back in the 2-Step Verification settings, open Backup codes and generate a set. Save them offline — a screenshot kept only on the same phone is not a real backup; write them in a notebook kept at home, or store them in a second safe place. Each code works once if you ever get locked out.
5. Check where you are signed in
While you are in Security, open Your devices and review every signed-in device. Recognise them all? Sign out of anything old, lost, or unfamiliar. Then check Recent security activity for logins you do not recognise. Two-step verification protects the future; this step cleans up the past.
What changes after turning it on?
Day to day, almost nothing: devices you use stay signed in. Only a NEW sign-in — a new phone, a browser that forgot you — will ask for the prompt or code. That tiny friction is exactly what stops an attacker in another country who bought or guessed your password.
Frequently asked questions
Will two-step verification log me out of my phone?
No. Your current devices stay signed in. The extra step appears only on new sign-ins or after you deliberately sign out everywhere.
What if I lose my phone after turning it on?
Use your backup method: SMS codes to your number, or one of the printed backup codes. This is why step 3 and 4 must not be skipped.
Is an authenticator app better than SMS codes?
Yes, slightly — an authenticator app (in the same 2SV settings) works without mobile signal and cannot be intercepted like SMS. Google prompts remain the easiest strong option for most people.
