How to set up two-factor authentication on Gmail

Google calls this "2-Step Verification" rather than two-factor authentication, but it's the same idea: once it's on, signing in from a new device needs your password and a code or prompt from your phone. It protects your whole Google Account, not just Gmail — the same login covers Drive, Photos, and anything else tied to that address. This guide covers the desktop browser version.

What you'll need: A Google Account. A phone that can receive a text message or phone call, or an authenticator app already installed. A desktop or laptop browser — Chrome, Firefox, Safari, or Edge.

Open your Google Account settings

Go to myaccount.google.com and sign in if you aren't already.

Open the Security section

Click Security in the menu on the left.

Find 2-Step Verification

Scroll to the How you sign in to Google section and click 2-Step Verification.

Start the setup

Click Get Started. Google may ask you to re-enter your password to confirm it's you.

Add your phone number

Enter the phone number you want to use, choose Text message or Phone call, then click Next.

Enter the code

Google sends a code by text or phone call. Type it into the box provided and click Next.

Turn it on

Review the summary shown, then click Turn On. 2-Step Verification is now active on your account.

Set up backup codes

Back on the 2-Step Verification page, scroll to Backup codes and click Set up. Click Download and save the list somewhere you can reach without signing into Gmail — each code works once, and they let you in if your phone is lost, broken, or has no signal.

Print the backup codes or store them somewhere separate from your phone. If your phone is the only way you can receive a code and it's lost, backup codes are the way back in.

Variations

Using an authenticator app instead of text messages

On the 2-Step Verification page, under Authenticator app, click Set up and follow the prompts to scan a QR code with an app such as Google Authenticator. This generates a new code every 30 seconds and works even without a phone signal — worth adding as a second method alongside your phone number, not instead of it.

Using a passkey or security key

Google increasingly offers passkeys — a fingerprint, face scan, or device PIN — as a way to sign in without a password or a text code at all. If you've already set one up, Google may skip the phone-prompt steps above and offer the passkey route directly from the Security page instead.

Approving a prompt instead of typing a code

Once 2-Step Verification is on and you're signed into Gmail on your phone, Google may send a "Is this you?" prompt to tap instead of asking for a text code — it appears automatically once set up, with nothing extra to configure.

Troubleshooting

The text message code never arrives

Check your phone has signal and that the number entered is correct. On the sign-in screen, look for an option to resend the code or switch to a phone call instead of a text message.

I've lost the phone I used to set this up

Use one of your backup codes to sign in, then go to Security › 2-Step Verification and remove the old phone number, replacing it with a new one. If you didn't save backup codes and have no other way to verify, you'll need Google's account recovery process instead.

I've used up all my backup codes

Sign in with your remaining working method, go to Security › 2-Step Verification › Backup codes, and click Get new codes. This invalidates any unused codes from the old list, so download and save the new set straight away.

Need a calculator rather than a guide? Try Simplicalcs →