Turn on two-factor authentication
Add a passkey, an authenticator app or emailed codes as a second step when you sign in, and keep recovery codes for when you lose a device.
Before you start
A signed-in account. For emailed codes, a verified email address.
Your password (or another existing method) — changing two-factor settings asks you to confirm it is you.
Steps
Step 1: Open security settings
Go to Settings and open Security. Your two-factor methods lists what is set up.
Step 2: Add a method
Choose one (you can add several):
- Add a passkey — use this device, a phone or a security key.
- Add an authenticator app — scan the QR code (or choose Can’t scan? Show the setup key), then enter the Six-digit code it shows.
- Turn on email codes — enter the six-digit code we send to confirm codes reach you.
If you are asked to Confirm it’s you, use your password or an existing method.
Step 3: Save your recovery codes
When two-factor is first turned on you are shown Save your recovery codes. Copy or download them and keep them somewhere safe: each code works once and lets you sign in if you lose every method. Generate new recovery codes replaces them — the old ones stop working straight away.
Step 4: Sign in with your second step
After your password or Google account, choose Use a passkey, Use your authenticator app, Email me a code or Use a recovery code, and choose Verify.
What you’ll see
Signing in needs your second step from now on. Sessions that were already signed in elsewhere are not signed out — sign out of them yourself if you are securing a lost device.
Troubleshooting
“This is your only method.”
The last method cannot be removed on its own. Add another method first, or choose Turn off two-factor authentication, type the confirmation phrase and choose Turn off.
“That code is not right.”
Check your device’s clock is set automatically — authenticator codes depend on it — and use the newest code.
“This sign-in has expired”
The second step must be completed within a few minutes, with a limited number of attempts. Choose Sign in again.
I lost every method and my recovery codes
Contact support from your account’s email address. We will verify your identity before turning two-factor off; support never signs you in on your behalf.
Related guides
Create your account and sign in
Sign up with your email address, verify it, and sign in — plus what to do if you forget your password.
Invite your team and manage roles
Invite colleagues by email, choose whether each is an admin or a member, and keep track of the seats your plan includes.