How to run a Google Account Security Checkup and review which apps have access
Google's Security Checkup is a single page that lists every device signed in to your account, every app and website you've ever connected to it, and anything Google thinks you should fix. Over the years most accounts collect connections to apps that were used once and forgotten, and each one is still a way in. This guide walks the checkup from top to bottom in a desktop browser and shows how to remove what you no longer need.
What you'll need: A Google Account and its password. A desktop or laptop browser — Chrome, Firefox, Safari or Edge. Phone steps are under Variations.
Open the Security Checkup page
Go to myaccount.google.com/security-checkup and sign in if asked. If you have more than one Google Account, check the profile picture in the top-right corner shows the account you mean to review.
Read the headline
The page opens with a one-line verdict — a green tick with No issues found, or a yellow or red banner such as Some suggestions for you or Security issues found. Below it is a list of sections, each with its own coloured icon. Yellow and red sections are the ones Google wants you to look at.
Work through every section anyway, including green ones. A green tick means Google found nothing automated to flag — it doesn't know whether you still use that app from 2019.
Check Your devices
Click Your devices to expand it. It lists every phone, tablet and computer signed in to your account, with the most recent activity for each.
For anything you don't recognise, or a device you've sold or given away, click it and choose Sign out. If you no longer have the device and the list shows one you don't know, change your password too — the Don't recognise something? link under the list takes you there.
Check Recent security activity
Expand Recent security activity. It shows the past 28 days of events that matter — new sign-ins, password changes, recovery details edited, 2-Step Verification turned on or off.
Click any event you don't remember doing. Google asks whether it was you; choose No, secure account and follow the prompts, which change your password and sign out every other session.
Check Sign-in & recovery
Expand Sign-in & recovery. Make sure the recovery phone number and recovery email address are ones you still control — an old work address or a number you no longer have is useless when you're locked out. Click either one to change it.
If this section also shows 2-Step Verification as off, turn it on. Our two-factor authentication guide covers that, and a passkey goes further still.
Review third-party connections
Expand Your connections to third-party apps & services. This is the long list — every app and website you've ever used Sign in with Google for, plus anything you've given direct access to your Gmail, Drive, Calendar or Contacts. Google flags the riskier ones, but read the whole list.
Click an entry to see exactly what it can reach. The wording tells you which kind it is: Has some access to your Google Account means it can read or change your data, while Can sign you in means it only uses Google as a login and sees your name and email address.
Remove anything you don't use
On an app's detail page, click Delete all connections you have with [the app's name], then Confirm. Repeat for each app you don't recognise or haven't used in months. If it turns out you did need one, signing in to that app again recreates the connection.
Finish with Saved passwords
Expand Saved passwords. This covers passwords stored in Google Password Manager, which Chrome uses. If it reports compromised, reused or weak passwords, click Go to Password Checkup and change the compromised ones first — they are the ones already in a known data breach.
When every section is green, or at least every yellow one is something you've chosen to accept, you're done. There is nothing to save — each change took effect as you made it.
Variations
Open the Gmail app, tap your profile picture in the top-right corner, then tap Manage your Google Account. Swipe the tabs along the top to Security and the checkup is at the top. The sections and buttons are the same as on the desktop page.
If connected apps are all you want to review, myaccount.google.com/connections opens that list on its own, with a search box above it. Click any entry and you're at the same detail page as step 7.
Some accounts show an extra Gmail settings section in the checkup. It lists any address your mail is being forwarded to and any filters that forward or delete mail automatically. Anyone who gets into an account tends to set these up to keep reading your email after you change the password, so a forwarding address you didn't add is a serious finding — remove it and change your password.
Troubleshooting
That's what removing it does. If the app matters, open it and sign in with Google again; it asks for permission afresh and reappears in the list. For a tool you only ever opened once, nothing is lost.
Developers sometimes name the connection differently from the app you'd recognise — a company name rather than a product name, or the name of a service a familiar app relies on behind the scenes. Click it and read the access details and the date it was granted. If the date rings no bells, delete the connection. The worst case is signing in to something again.
The green tick only means the automated checks passed. Go through steps 3, 4 and 6 by hand, then change your password from the Security page under How you sign in to Google. Changing the password signs out every other device at the same time.
Google Workspace administrators control which apps can connect and whether users can change recovery details. If a section won't let you act, ask whoever manages your organisation's Google accounts.
Need a calculator rather than a guide? Try Simplicalcs →