Turn On Two-Step Verification in Gmail
Add an extra security layer to your Google account and reduce hacking risk.
Why 2-Step Verification matters
Passwords leak – through phishing pages, reused passwords or data breaches of other websites. With 2-Step Verification (2SV), a thief who knows your password still cannot sign in without your phone or security key. Your Gmail is also the “master key” to YouTube, Drive, Photos, Google Pay and every website where you use “Sign in with Google”, so protect it first.
Turn it on (5 minutes)
- Open myaccount.google.com on a computer or the Google app → Manage your Google Account.
- Go to Security (on newer layouts: Security & sign-in).
- Under How you sign in to Google, click 2-Step Verification → Turn on.
- Confirm your phone number. Google sends a code by SMS – type it in.
- Make sure Google prompts are on for your phone (you get a “Yes, it’s me” tap).
- Add at least one backup option (next section) before you finish.
Second steps compared
| Method | How it works | Safety |
|---|---|---|
| Passkey | Unlock with your phone’s fingerprint/face/PIN; no code to type | Best – resistant to phishing |
| Security key | A small USB/NFC key you touch | Best – resistant to phishing |
| Google prompt | “Is it you trying to sign in?” → Yes/No on your phone | Good; never tap Yes if you did not sign in |
| Authenticator app | 6-digit code that changes every 30 s (Google Authenticator, Microsoft Authenticator) | Good; works without mobile network |
| SMS / voice code | Code sent to your number | Better than nothing; SIM-swap and OTP-sharing scams can defeat it |
| Backup codes | 10 one-time codes you print | Emergency use when the phone is lost |
Do not lock yourself out: backups
- On the 2-Step Verification page, open Backup codes → Get backup codes → print or write them and keep them with important papers (not in your phone gallery).
- Add a second phone number of a family member as a backup.
- Set a recovery email and recovery phone in Security → How you sign in.
- If you change your mobile number, update it here before deactivating the old SIM.
Even better: create a passkey
In Security → Passkeys and security keys → Create a passkey. Your Android phone or iPhone stores it, and signing in needs only your screen lock. A fake login page cannot steal a passkey, which makes it the strongest protection against phishing.
Never share a code or approve a prompt you did not start
Also check Security → Your devices every few months and sign out of phones and computers you do not recognise. More: account hacked? recovery steps.
Turn it on for your other accounts too
| Service | Where |
|---|---|
| Settings → Account → Two-step verification → set a 6-digit PIN | |
| Instagram / Facebook | Accounts Centre → Password and security → Two-factor authentication |
| Microsoft (Outlook, Office) | account.microsoft.com → Security → Two-step verification |
| DigiLocker / banking apps | Use app PIN + device binding; never share OTP |
2-Step Verification क्यों ज़रूरी है
Passwords leak होते हैं – phishing pages, दोहराए passwords या दूसरी websites के data breach से। 2-Step Verification (2SV) के साथ, password जानने वाला चोर भी आपके phone या security key के बिना sign in नहीं कर सकता। आपका Gmail YouTube, Drive, Photos, Google Pay और हर उस website की “master key” है जहाँ आप “Sign in with Google” इस्तेमाल करते हैं, इसलिए पहले इसे बचाएँ।
चालू करें (5 मिनट)
- Computer पर myaccount.google.com या Google app → Manage your Google Account खोलें।
- Security पर जाएँ (नए layout में: Security & sign-in)।
- How you sign in to Google में 2-Step Verification → Turn on।
- अपना phone number पक्का करें। Google SMS से code भेजता है – उसे लिखें।
- पक्का करें कि phone के लिए Google prompts चालू हैं (आपको “Yes, it’s me” tap मिलता है)।
- ख़त्म करने से पहले कम से कम एक backup option जोड़ें (अगला section)।
दूसरे steps की तुलना
| तरीका | कैसे काम करता है | सुरक्षा |
|---|---|---|
| Passkey | Phone के fingerprint/face/PIN से खोलें; कोई code type नहीं | सबसे अच्छा – phishing से सुरक्षित |
| Security key | छोटी USB/NFC key जिसे छूते हैं | सबसे अच्छा – phishing से सुरक्षित |
| Google prompt | “क्या आप sign in कर रहे हैं?” → phone पर Yes/No | अच्छा; sign in न किया हो तो कभी Yes न दबाएँ |
| Authenticator app | हर 30 s बदलने वाला 6 अंकों का code (Google Authenticator, Microsoft Authenticator) | अच्छा; mobile network के बिना चलता है |
| SMS / voice code | आपके number पर code | कुछ न होने से बेहतर; SIM-swap और OTP-sharing scams इसे हरा सकते हैं |
| Backup codes | 10 one-time codes जिन्हें print करते हैं | Phone खोने पर आपात इस्तेमाल |
ख़ुद को बाहर न करें: backups
- 2-Step Verification page पर Backup codes → Get backup codes → print करें या लिखकर ज़रूरी कागज़ों के साथ रखें (phone gallery में नहीं)।
- Backup के रूप में परिवार के किसी सदस्य का दूसरा phone number जोड़ें।
- Security → How you sign in में recovery email और recovery phone सेट करें।
- Mobile number बदलें तो पुराना SIM बंद करने से पहले यहाँ update करें।
और बेहतर: passkey बनाएँ
Security → Passkeys and security keys → Create a passkey। आपका Android phone या iPhone इसे रखता है, और sign in के लिए सिर्फ़ screen lock चाहिए। नकली login page passkey नहीं चुरा सकता, इसलिए phishing से यह सबसे मज़बूत सुरक्षा है।
जो आपने शुरू नहीं किया वह code share या prompt approve न करें
हर कुछ महीनों में Security → Your devices भी देखें और अनजान phones और computers से sign out करें। और: Account hack हुआ? recovery steps।
अपने दूसरे accounts पर भी चालू करें
| Service | कहाँ |
|---|---|
| Settings → Account → Two-step verification → 6 अंकों का PIN | |
| Instagram / Facebook | Accounts Centre → Password and security → Two-factor authentication |
| Microsoft (Outlook, Office) | account.microsoft.com → Security → Two-step verification |
| DigiLocker / banking apps | App PIN + device binding; OTP कभी share न करें |
Frequently Asked Questions
How do I turn on 2-Step Verification in Gmail?
Go to myaccount.google.com → Security → 2-Step Verification → Turn on, confirm your phone number, then add backup codes and a backup phone.
What if I lose my phone after turning on 2-Step Verification?
Use a backup code or your backup phone to sign in, then remove the lost phone from Your devices and set up the new phone. Without any backup you must use Google’s account recovery, which can take days.
Is SMS-based verification safe enough?
It is much better than a password alone, but passkeys, security keys, Google prompts or an authenticator app are safer because SMS codes can be stolen through SIM swap or tricked out of you on a call.
