Secure your Google Account

Open the correct account and run Security Checkup

1. Open Google Account on your own device. Check the profile picture or initial and confirm the email address you intend to secure.
2. Open Security Checkup. Inspect each recommendation, starting with recent security activity.
3. If you see activity you did not initiate, stop routine setup and follow Recover a hacked account.

These account pages work in a browser on iPhone, iPad, Android, Mac and Windows. Use this one route rather than looking for different device menus.

Official instructions

Verify recovery email and phone

1. In Google Account, open Security & sign-in. Under How you sign in to Google, inspect Recovery phone and Recovery email where offered.
2. Add or update a phone number you control and a different email inbox you can access. Complete any verification prompts.
3. Open the recovery inbox and confirm you can sign in without relying only on this Google account. Keep your current Google session open until the recovery details are verified.

Google may continue offering the previous recovery information for seven days after a change. If that old information belongs to an attacker, use the recovery guide immediately. Availability varies by account; use the linked instructions if labels differ.

Official instructions

Protect sign-in with a unique password and two-step verification

1. Confirm this account has its own password saved in your password manager. Replace it through Google Account → Security & sign-in → Password if it is reused or exposed.
2. Open Security & sign-in → How you sign in to Google → 2-Step Verification. If it is off, follow the setup prompts.
3. When offered a choice, start with a Google prompt on your own locked phone rather than text-message codes. Keep a usable backup method and confirm verification is enabled.

Use the password-manager guide for unique passwords. If your account offers passkeys, you can add one in the next step. Only approve prompts for a sign-in you started.

Official instructions

Add a passkey on your own device

1. On a personal device protected by a screen lock, open Google Account → Security & sign-in → Passkeys and security keys.
2. Inspect existing passkeys. If you do not already have one on a device you control, choose Create a passkey when offered and follow the prompts.
3. Keep your original session open and test signing in from another browser window using the passkey. Confirm it unlocks with your device’s supported PIN or biometrics.

Do not create a passkey on a shared or public device. Someone able to unlock the device may be able to use its passkey. If passkeys are unavailable for your account, keep two-step verification enabled and record this step as unavailable.

Official instructions

Save backup codes separately

1. Open Google Account → Security & sign-in → 2-Step Verification → Backup codes.
2. Generate codes if you have none, then print or save them in a secure location you can reach without your phone or this Google account.
3. If an old set is lost or exposed, generate a replacement and discard the invalid old set. Record only the storage location on your progress checklist.

Each backup code works once. A newly generated set invalidates the old set. Accounts in Advanced Protection cannot download these codes; use that program’s recovery instructions instead. Do not paste codes into the tracking checklist or share them with a caller.

Official instructions

Sign out old sessions and remove unwanted app access

1. Open Google Account → Security & sign-in → Your devices → Manage all devices. Inspect the device and session details.
2. Sign out sessions you no longer use. If you cannot identify a session, sign it out and follow the recovery guide if the activity looks unauthorized.
3. Open the third-party connections page. Inspect each service and the access it has. Remove access you no longer need.

Multiple sessions on one device can be normal, and location estimates can differ. Before removing Sign in with Google from a service you still use, establish another working sign-in there. Removing a connection does not erase data that service already holds. Google’s connected-app instructions.

Official instructions

Test access and schedule a review

1. Using a second browser window, confirm your intended sign-in method works while keeping the original session open.
2. Check that recovery information and backup-code storage remain accessible if your main phone is lost.
3. Set a calendar reminder three months from today to repeat Security Checkup and review recovery details, devices and connected apps.

If you also use Gmail, follow the email sign-in guide. For unexpected forwarding rules or missing messages, use the recovery guide.