Your Google account is the one to protect first
Think about what’s tied to your Google account. Gmail, Google Drive, YouTube, Google Photos, maybe your Android phone backup. If someone gets into your Google account, they can read your email, reset passwords for other services, and access years of personal data.
Google calls their version “2-Step Verification,” and they’ve been pushing users toward it aggressively. There’s a good reason for that. Turning it on is one of the most impactful things you can do for your security, and it takes a few minutes.
For background on how the codes work, see What is TOTP?.
What you’ll need
- A Google account
- An authenticator app on your phone (Google Authenticator, Authy, 1Password, or any TOTP app)
Step-by-step setup
1. Go to your Google Account settings
Visit myaccount.google.com and sign in. Or click your profile picture in any Google service and select “Manage your Google Account.”
2. Open the Security tab
In the left navigation, click Security. Scroll down to the section called “How you sign in to Google.”
3. Click “2-Step Verification”
You’ll see a “2-Step Verification” option. Click it. Google may ask you to enter your password again.
4. Get past Google’s default prompts
Here’s where Google gets a little opinionated. By default, they’ll try to set you up with Google Prompts, which are push notifications to your phone. That’s fine as a method, but if you want to use an authenticator app instead (and you should, since it works even without internet), you may need to either:
- Set up Google Prompts first, then add an authenticator app afterward
- Or look for an “Authenticator app” option further down the setup page
Google’s UI changes occasionally, so the exact flow may look slightly different depending on when you’re reading this. The key is to look for “Authenticator app” as an option, even if it’s not the first one Google presents.
5. Set up the authenticator app
Once you get to the authenticator app option, click “Set up” or “Add authenticator app.” Google will ask what kind of phone you have (Android or iPhone). Pick yours and hit Next.
Google shows you a QR code. Open your authenticator app, add a new account, and scan it.
If you can’t scan the QR code, look for a “Can’t scan it?” link. Google will show you a text-based secret key you can type into your app manually.
6. Enter the 6-digit code
Your authenticator app will display a code. Type it into Google and click Verify.
That’s it. The authenticator app is now linked to your account.
Backup codes
Google generates backup codes you can use if you lose access to your authenticator. To find them:
- Go back to the 2-Step Verification settings page
- Look for “Backup codes” and click “Set up” or “Show codes”
- Google gives you ten 8-digit codes
Each code works once. Save them somewhere separate from your phone. Print them out, put them in a password manager, or write them down and store them in a safe place. If your phone dies and you don’t have these, recovering your Google account is a multi-day process that involves identity verification.
Other second-factor options
Google lets you stack multiple methods, and having more than one is a good idea. Your options include:
- Google Prompts — push notifications to your Android or iPhone with Google apps installed
- Authenticator app — the TOTP method we just set up
- Security keys — hardware devices like YubiKey or Google Titan
- Phone number — SMS codes as a fallback
My suggestion: set up the authenticator app as your primary method, and keep backup codes stored safely. If you have a security key, add that too. SMS works as a last resort, but it’s the weakest option.
A note on Google Prompts vs. authenticator apps
Google Prompts are convenient. You get a notification, tap “Yes,” and you’re in. But they require an internet connection on your phone and they depend on Google’s servers being reachable.
An authenticator app generates codes locally. No network needed. It works on a plane, in a basement, or when your carrier is having issues. It also works across services, not just Google. The same app can hold codes for GitHub, Discord, your bank, and anything else that supports TOTP.
Quick recap
- Go to myaccount.google.com > Security > 2-Step Verification
- Work through Google’s setup flow
- Add an authenticator app (scan the QR code)
- Verify with a 6-digit code
- Generate and save your backup codes
It takes a few minutes, and given how much stuff lives in your Google account, it’s time well spent.
If you want to try generating TOTP codes before setting anything up, 2fa.zip lets you experiment right in your browser with nothing sent to a server.