Set up 2-Step Verification on your Google Account – prompts, app, key or passkey

A password is something you know – and therefore something that can be taken from you: through phishing, through a data breach at the service, or through malware that lifts saved passwords off your device. The BSI describes two-factor authentication as a combination of factors from different categories: knowledge (password, PIN), possession (phone, chip card, security key) or biometrics (fingerprint, face). Whoever has only the password does not get past the second barrier. Google describes the feature on its help page in exactly that way: as an extra layer of security in case your password is stolen.

The Google Account belongs at the top of the list, ahead of social media and shops. For many people it is their email inbox, and via «Forgot password» almost every other account can be reset through that inbox – which is why NCSC Switzerland, in its weekly review 19/2024, calls the email account the «main hub» for access to internet services. Add to that Photos, Drive, Calendar, location history, YouTube purchases and, if you use Chrome, Google Password Manager with all your saved passwords. A hijacked Google Account is therefore not a single account but the whole keyring.

NCSC Switzerland and the BSI both recommend turning on the second factor wherever a service offers it. The BSI adds that many services offer the feature but leave it off by default – so a look at the sign-in settings pays off even for accounts you consider secure. That the gap is real is shown by the Swiss study «SME Cybersecurity 2026»: only just over half of the businesses surveyed had fully rolled out multi-factor authentication (→ Over 35,000 Swiss SMEs hit by serious cyberattacks – and only one in four tests its backups). The second factor does not replace a good password but complements it – how to build a strong password is in our guide (→ Create a strong password – and what is actually secure in 2026).

In its technology brief «Security categories for authentication procedures, methods and services» (September 2026), NCSC Switzerland sorted common methods into the categories «low», «medium» and «high». An asterisk marks methods that protect against real-time phishing and man-in-the-middle attacks. Username and password alone sit in «low» – such methods, says NCSC Switzerland, should in principle no longer be used, even if the data is transmitted over an encrypted connection. A password with an SMS code and software codes such as Google or Microsoft Authenticator sit in «medium» without an asterisk: they protect against stolen passwords, but not if you enter the code yourself on a fake page. On SMS, NCSC Switzerland also notes that the security of SMS-based methods is questionable and that they should only be used if there is no better alternative.

Phishing-resistant are the two FIDO methods: synchronised passkeys, as Apple and Google distribute them via the keychain and the password manager, reach «medium*»; FIDO2 hardware keys without synchronisation and export reach «high*». The difference, according to NCSC Switzerland, lies mainly in whether the private key is held in dedicated hardware or can be copied to several devices via a cloud. Google's own assessment matches: its help page lists passkeys and hardware security keys as the way to increase phishing protection, and codes by text message or call as methods that «can be vulnerable to phone number-based hacks».

For everyday use that means: Google prompts are convenient and clearly better than SMS, because they go only to signed-in devices and show you the device and location of the sign-in attempt – but they do not protect you from yourself if you tap «Yes» on a fake page. The authenticator app is independent of the mobile network and of Google's push services, but also stays in «medium». If you want the phishing-resistant level, use a passkey on your phone or computer; if you want the highest level or are particularly at risk, buy two hardware keys. And whatever the method: the backup codes are part of it, otherwise the protection turns into a lockout.

On 10 October 2023 Google made passkeys the default option for personal Google Accounts: since then Google suggests creating a passkey when you sign in, and the setting «Skip password when possible» is turned on. According to the Google blog, passkeys are 40 % faster than passwords, and anyone who prefers to stay with a password simply turns the option off. Technically, a passkey is a key pair: the private key stays on your device or in your keychain, Google only knows the public one. When you sign in, you confirm with your fingerprint, face or PIN that you can unlock the device – according to Google, the biometric data stays on the device.

Because, according to the Google help page, a passkey cannot be shared, copied, written down or accidentally given away, there is nothing a phishing page could ask for, and it only works for the genuine Google address. That is also why the second step is skipped with a passkey: possession of the device is already proven. Google's warning on this matters: only create passkeys on devices you personally own – anyone who can unlock your device can get into your Google Account with it, even if you have signed out there. A passkey has no place on a shared tablet or the family PC.

How widespread this is can be seen from the FIDO Alliance, which is responsible for the standard: on 15 October 2026 it reported around 7 billion passkeys worldwide, and at the 15 major consumer services of its «Passkey Index» more than a third of successful sign-ins now run via passkey – according to FIDO nearly three times faster than with a password and a classic second factor, and every service that measures phishing has since reported fewer successful attacks. The password nevertheless remains at Google as a fallback and therefore has to be just as strong as before; the section «Passkeys: the next step» in our password guide (→ Create a strong password – and what is actually secure in 2026) makes a good companion read.

The most common reason for a lockout is not the hacker but the lost, stolen or broken phone. On its help page «Fix common issues», Google recommends two things first: sign out of the lost device and change your Google Account password – both can be done from any other device on which you are signed in. Then choose «Try another way» on the sign-in screen and use what you prepared: a backup code, another signed-in phone, a second phone number, a hardware security key or a passkey on another device.

Two quiet helpers are often still there: a computer on which you ticked «Don't ask again on this computer» may, according to Google, let you in without a second step – from there you can reorganise your methods. And you can ask your mobile provider to transfer your phone number to a new SIM or eSIM; SMS codes then arrive again. What an eSIM is and how the switch works is explained in our glossary (→ What is an eSIM? How the digital SIM card works). If you use Google Authenticator with account synchronisation, the codes are automatically back once you sign in on the new device – without synchronisation they are gone with the old device, and you need the backup codes.

If you have neither a fallback method nor backup codes, account recovery via the recovery email address or phone number remains. Google asks questions about the account, and because 2-Step Verification is active, the check can take 3-5 business days according to the help page. That is exactly why the quarter of an hour in the tab «Backup codes and recovery» is worth it beforehand. The BSI also urges you to use a secure, multi-step procedure for recovery: a recovery route that gets by with a single factor weakens the whole protection – attackers go for precisely that point.

What applies to Google here applies to every important account: Apple Account, Microsoft account, online banking, mobile provider's customer portal, Instagram, WhatsApp. The BSI explicitly names online banking, online shopping and accounts with extensive rights such as email and social media as the cases where the second factor pays off first, and always advises against turning it off again. The order after the Google Account: email (if not Gmail), Apple or Microsoft account, password manager, bank and payment services, mobile provider, then social media and shops. The wave of hijacked WhatsApp accounts in October 2026 shows how urgent this is for messengers: NCSC Switzerland counted more than 50 reports in a single month, and two-step verification with a PIN is what protects you (→ Fake voting links hijack WhatsApp accounts: over 50 reports in October – Switzerland's NCSC warns).

If you protect many accounts with authenticator codes, a housekeeping question arises: where do the codes live, and what happens when you change devices? Google Authenticator synchronises them with your Google Account; password managers offer the same in their own vault. According to our comparison of 16 October 2026, NordPass Premium includes an authenticator, Bitwarden has one in the free plan and in the vault from Premium, and Proton Pass Plus comes with one too (→ Best password managers 2026: 1Password, NordPass, Bitwarden and Proton Pass compared). NCSC Switzerland recommends exactly this combination on its page «Device security»: a unique password for each service, two-factor authentication wherever possible, and a password manager that supports it. It is convenient to have the password and the code in the same vault – if you want to keep the factors strictly separate, use a separate app on your phone for the codes, as the BSI recommends for the most secure case.

One misunderstanding to finish: a VPN protects your connection, not your account. It encrypts the route between your device and the VPN server and hides your IP address, but it does not stop anyone from signing in to Google with your stolen password – and it does not recognise a phishing page (→ What is a VPN? How the virtual private network works). The second factor and a VPN solve different problems; if you want both, set up the second factor first and the VPN afterwards (→ How to set up a VPN on your iPhone – with an app or by hand). And if you were signed in on someone else's computer, clear the cookies and saved logins afterwards (→ Clear cache and cookies – in every browser, on your computer and your phone).

Journalists, activists, politicians, lawyers or anyone else who might be targeted for other reasons are named by Google as the audience for its Advanced Protection Program. According to Google it is free of charge; at most you pay for the security keys. The difference from normal 2-Step Verification: you can only sign in with a passkey or a hardware security key – prompts, SMS and app codes are no longer available. In addition, Google limits third-party apps' access to your data, puts stronger checks on suspicious downloads and tightens account recovery so that it cannot serve as a back door.

Before enrolling, Google says, you should add a recovery email address and phone number, turn on 2-Step Verification and have one or, better, several security keys ready. Backup codes cannot be downloaded in the programme – the substitute is the second key. If you lose your only key, according to the help page only account recovery remains. Workspace accounts from an employer or school can take part if the administrator has enabled the programme; nobody can be forced to enrol. For most private individuals the programme is more effort than necessary – a passkey plus backup codes plus a second method is enough. But if you fear targeted attacks, this is the strongest protection Google offers.