Secure Your Google Account on Android: 2FA, Passkeys, and Recovery

I have a friend who lost her entire digital life—photos, emails, contacts—because she used the same password for her Spotify and her Gmail. When Spotify had a data breach, someone walked right into her Google account and changed the recovery phone number before she even woke up. I don't want that to happen to you. Your Google account is the "master key" for your Android phone. If someone gets in, they can wipe your device or see your private backed-up photos. Securing it isn't just about a long password anymore; it's about using the modern tools Google has built to make it nearly impossible for a stranger to get in, even if they know your password.

Switch to passkeys

Passkeys are the biggest change to security in years. Instead of a password, which is just a string of text you have to remember (and that can be stolen), a passkey uses your phone's own screen lock—like your fingerprint or face scan—identifying you to Google. To set this up, go to Settings > Google > Manage your Google Account. Tap the Security tab and look for Passkeys. Google will walk you through "creating" one for your current device.

Once you have a passkey, you don't have to type your password when signing into Google on a new device. You'll just get a prompt on your phone asking for your fingerprint. It's much faster and, more importantly, it can't be "phished." A hacker can't trick you into giving them your fingerprint over a fake website. One thing to know: passkeys are relatively new, so while they work great with Google and a few other big sites like Amazon, you'll still need passwords for some of the smaller, older corners of the internet. It's not a perfect "password-free" world yet, but it's getting there.

Enable two-step verification

If you aren't ready for passkeys, you absolutely must have Two-Step Verification (2SV) turned on. This is your second line of defense. In the same Security tab of your Google Account settings, tap 2-Step Verification. I recommend using "Google Prompts" as your primary method. This means when you log in on a computer, a bubble pops up on your Android phone asking, "Are you trying to sign in?" You just tap "Yes."

Avoid using SMS (text message) codes if you can. "SIM swapping" is a real thing where hackers trick carriers into moving your phone number to their phone. If that happens, they get your security codes. If you want to be a pro, use an Authenticator App (like Google Authenticator or Aegis) or even a physical security key. For most of us, though, the on-screen "Google Prompt" is a huge upgrade over just a password. I remember feeling a bit annoyed the first time I had to reach for my phone to sign in on my laptop, but then I realized that extra five seconds is the only thing standing between me and a total account takeover.

Set recovery options

This is where my friend went wrong. She didn't have an up-to-date recovery email. You need to make sure Google knows how to reach you if you get locked out. Under the Security tab, scroll down to How you sign in to Google and check Recovery phone and Recovery email. This should be a phone number you actually still have and an email address you can access that isn't your primary Gmail (like a work email or an Outlook/iCloud account).

I also highly recommend Backup Codes. These are a list of ten one-time-use codes you can print out. If you lose your phone and can't do the 2SV prompt, these codes are the only way back in. I keep a printed copy of mine in my physical safe at home. It sounds paranoid until your phone ends up at the bottom of a lake and you realize you're locked out of your entire digital existence. Trust me, take the five minutes to generate these and put them somewhere safe.

Review device access

Finally, it's worth doing a "spring cleaning" of which devices are actually logged into your account. In the Security tab, scroll down to Your devices and tap Manage all devices. I was shocked to find that my old Pixel 4, which I sold three years ago, was still technically "authorized." I hadn't wiped it correctly or forgotten to sign out. To an attacker, that old device could have been an open door.

Go through the list and if you see an old phone, an old tablet, or a "Linux device" that you don't recognize, tap it and select Sign out. This is also a good place to look for "Third-party apps with account access." Sometimes we give a random "Which Disney character are you?" quiz access to our Google data and forget about it. If you see an app in that list that you haven't used in six months, revoke its access. The fewer "open doors" you have, the safer you are.