How to Secure Your Google Account and Gmail, Step by Step

If you have ever wondered how to secure my Google account without spending an afternoon on it, this guide is for you. Your Google account is the key to Gmail, Photos, Drive, YouTube, saved passwords in Chrome and often your Android phone, so one stolen password can expose a lot. The steps below take about 20 to 30 minutes on a computer or phone, and most of them you only need to do once.

Everything here follows Google's own help pages as they read in November 2026. Google renames menus from time to time, so if a label looks slightly different on your screen, look for the closest match.

Before you start

• Have the phone you carry every day nearby, since several steps send a prompt or code to it.
• Open myaccount.google.com in a browser where you are already signed in.
• Make sure your phone and computer are running current software. Google lists updating your software as one of its core security steps.
• If you use a password manager, open it now so you can save a new password in one go.

Stage 1: Run Google's Security Checkup

The Security Checkup is a short guided review that flags weak spots for you, so it is the best first move.

1. Go to myaccount.google.com/security-checkup. You can also click your profile picture at the top right of a Google page and choose Recommended actions.
2. Work through each card it shows. Typical items include recovery details, signed in devices, recent security events and apps with access to your data.
3. Fix anything marked with a yellow or red warning before moving on.

The checkup does not replace the steps below, but it often catches the one thing you forgot.

Stage 2: Fix your password and recovery details

Change to a strong, unique password

If your Google password is used anywhere else, change it first. Google's advice is simple: use unique and strong passwords. Reused passwords are a common way accounts get taken over after some other site is breached. If juggling dozens of passwords sounds painful, read our explainer on whether you need a password manager.

Add a recovery phone and email

Recovery details are how you get back in if you are ever locked out.

1. At myaccount.google.com, open Security & sign-in.
2. Under How you sign in to Google, click Recovery phone or Recovery email.
3. Choose Add recovery phone or Add recovery email, or Edit to update an old one.

Two details from Google's help page are worth knowing. Changes can take up to 7 days to fully apply, and Google says not to use a Google Voice number as your recovery phone. You can also set up Recovery contacts, which are trusted people who can help confirm it is you. A request you send to a contact stays open for 7 days.

Stage 3: Turn on 2-Step Verification

This is the single biggest upgrade you can make. Even if someone learns your password, they still need your second step.

1. In Security & sign-in, find How you sign in to Google.
2. Select Turn on 2-Step Verification and follow the on-screen steps.
3. Pick your main method. Google prompts are the easiest: a notification appears on your Android phone, or on an iPhone with the Gmail, Google Photos, YouTube or Google app installed, and you tap Yes to allow the sign in or No to block it.
4. Add at least one backup method. Options include an authenticator app such as Google Authenticator, a 6-digit code by text or voice call, a hardware security key, or backup codes.
5. Download or print your backup codes. These are 8-digit codes you can use if your phone is lost. Store them somewhere safe and offline.

Text message codes work, but an app, a prompt or a security key is harder for attackers to intercept. Google also notes that a newly added phone number can take up to 7 days to be trusted.

Stage 4: Add a passkey

A passkey lets you sign in with your fingerprint, face or screen lock instead of typing a password. Because there is nothing to type, there is nothing for a fake login page to steal. Google says a passkey also skips the second verification step, since it already proves you have your device.

1. Go to myaccount.google.com/signinoptions/passkeys.
2. Tap Create a passkey and confirm with your device's screen lock.
3. To use a physical security key instead, tap Use another device.

According to Google, passkeys work on computers running at least Windows 10, macOS Ventura or ChromeOS 109, phones on Android 9 or iOS 16 and later, and FIDO2 security keys. Supported browsers include Chrome 109, Safari 16, Edge 109 and Firefox 122 or newer.

If you would rather keep typing your password first, turn off Skip password when possible under How you sign in to Google.

Stage 5: Clean up devices, apps and Gmail settings

Sign out of devices you do not recognize

1. In Security & sign-in, find the Your devices panel and click Manage all devices.
2. Tap any device you do not recognize, or no longer own, and choose Sign out.

Google points out that several sessions can share the same device name, so sign out of all of them if one looks wrong. You can also get to this list at google.com/devices.

Remove apps you no longer use

Old quizzes, games and sign in with Google services can keep access to your data for years. Visit myaccount.google.com/linkedapps to review linked apps and remove any you do not use. Google also recommends removing browser extensions you do not need.

Check Gmail forwarding and filters

Attackers who get in often set up a quiet forwarding rule so they keep receiving your mail after you change the password.

1. In Gmail on a computer, click Settings, then See all settings.
2. Open the Forwarding and POP/IMAP tab. If you see a forwarding address you did not add, choose Disable forwarding and click Save Changes.
3. Open the Filters and Blocked Addresses tab and delete any filter that forwards or deletes mail you did not set up.

Stage 6: Consider Advanced Protection

Google's Advanced Protection Program is meant for people at higher risk of targeted attacks, such as journalists and activists. It requires a passkey or security key to sign in, limits which outside apps can reach your data and makes account recovery stricter. Google says it costs nothing. Before you enroll, add recovery details and turn on 2-Step Verification, and buy security keys if you plan to use them. One trade off: you cannot download backup codes while enrolled.

For most people, Stages 1 to 5 are enough.

When something does not work or looks wrong

You do not see a Google prompt. Make sure the Google or Gmail app is installed and signed in on that phone, notifications are allowed, and the phone has a data connection. Use a backup code or authenticator app to get in meanwhile.

Recovery phone changes are not showing. Google says these can take up to 7 days. Wait before changing them again.

You spot activity you do not recognize. Open Security & sign-in, then Recent security events and Review security events. Choose No, it wasn't me for anything unfamiliar and Google will walk you through securing the account. Then change your password, recheck your recovery details and sign out of strange devices, as covered in Google's help page for a compromised account.

You are already locked out. Use Google's account recovery page at accounts.google.com/signin/recovery, ideally from a device and location you have used before. Never share a verification code with someone who calls or texts you about your account. That is a classic trick covered in our guide on what phishing is.

The full lists of 2-Step Verification methods and passkey requirements are on Google's 2-Step Verification help page and passkeys help page. Once your Google account is locked down, give your other logins the same treatment with our 10-minute account protection guide, and if your email ever shows up in a breach notice, follow our data breach checklist. You can find more guides like this in our Tech section.

One last habit worth keeping: set a calendar reminder to run the Security Checkup every few months. It takes five minutes and catches the slow drift of old devices and forgotten apps.