How to Secure Google Account with Google Authenticator

This guide walks you through setting up Google Authenticator to add two-factor authentication (2FA) to your Google account. This adds a second layer of security beyond your password, so even if someone steals your password, they can’t get in without the code from your phone. You’ll need your phone (Android or iPhone) and access to your Google account on a computer or phone.

What You’ll Need

Your Google account password
A smartphone (Android or iPhone) with the Google Authenticator app installed (download from the official app store)
Access to your Google account on a computer or another device to complete the setup

Step-by-Step

Install Google Authenticator – On your phone, open the App Store (iOS) or Google Play Store (Android), search for “Google Authenticator,” and install the official app by Google LLC.
Sign in to your Google Account – On your computer or phone browser, go to myaccount.google.com and sign in with your credentials.
Navigate to Security settings – In the left menu, click “Security.” If you’re on mobile, tap the menu icon (three lines) and select “Security.”
Find 2-Step Verification – Scroll to the “How you sign in to Google” section and click “2-Step Verification.” You may be asked to sign in again.
Start setup – Click “Get started” and enter your password if prompted.
Choose Authenticator app – On the “Set up a second step” page, select “Authenticator app” (or “Google Authenticator” depending on the interface) and click “Set up.”
Scan the QR code – A QR code will appear on your screen. Open the Google Authenticator app on your phone, tap the “+” icon (or “Get started” on first run), choose “Scan a QR code,” and point your camera at the screen. If you can’t scan, click “Can’t scan it?” to enter the secret key manually.
Verify the code – After scanning, the app will display a 6-digit code that changes every 30 seconds. Enter that code into the Google setup page and click “Verify.”
Confirm and finish – Google will confirm the setup. Click “Done” or “Turn on” to enable 2-Step Verification. You’ll see a confirmation screen.
Add backup codes (recommended) – While still in 2-Step Verification settings, scroll to “Backup codes” and click “Show codes.” Save these codes in a secure place (like a password manager) – they’re your only fallback if you lose your phone.

Common Mistakes

Skipping backup codes – If you lose your phone without backup codes, you may be locked out of your account for days. Always save them.
Not checking the time on your phone – Google Authenticator relies on your phone’s clock. If the time is wrong, codes won’t work. Enable “Automatic date & time” in your phone settings.
Deleting the app before disabling 2FA – If you uninstall the app without turning off 2-Step Verification, you’ll have trouble signing in. Always disable 2FA first or have backup codes ready.
Scanning the QR code on the wrong device – The QR code is tied to your Google account. Scan it with the phone you want to use for codes, not a different one.
Ignoring the “Can’t scan it?” option – If your camera is broken, you can enter the secret key manually. It’s easy to miss, but it’s there.

Tips

Use a password manager – Store your backup codes and the secret key (if you saved it) in a password manager for extra safety.
Set up more than one device – You can add the same account to another phone (e.g., a tablet) by scanning the QR code again from the Google settings. That way, you have a backup.
Keep your phone’s OS updated – Google Authenticator works best on the latest OS versions. Updates also fix security bugs.
Test your backup codes – After saving them, try using one code to sign in on a different device to make sure they work.
Consider using a security key – For even stronger security, you can add a physical security key (like a USB or Bluetooth key) as a second step. Google Authenticator is good, but a key is phishing-resistant.

Troubleshooting

Codes not working? – First, check that your phone’s time is set to automatic. Go to Settings > Date & Time and enable “Automatic.” Then try again. If it still fails, remove the account from the app and re-scan the QR code.

Lost your phone? – If you have backup codes, use one to sign in. If not, go to Google’s Account Recovery page (accounts.google.com/recovery) and follow the prompts. You may need to wait for verification.

App won’t scan the QR code? – Make sure the screen is bright and you’re holding the phone steady. If the camera is faulty, tap “Can’t scan it” and enter the secret key manually. The key is a long string of letters and numbers.

Set up but still not prompted for a code? – After enabling 2FA, sign out of your Google account and sign back in. You should see a prompt for the code on a new device or after clearing cookies.

Authenticator shows a different code than expected? – Each code is valid for 30 seconds. Wait for the next code and try again. If it still fails, your phone’s clock is likely off – fix that.

Frequently Asked Questions

Do I need an internet connection for Google Authenticator to work? – No. The app generates codes offline using the secret key and your phone’s time. It works without Wi-Fi or cellular data.

Can I use Google Authenticator for other accounts? – Yes. The app supports multiple accounts. You can add any service that uses TOTP (Time-based One-Time Password) by scanning their QR code.

What happens if I switch to a new phone? – You have two options: 1) Transfer the account by scanning the QR code from the old phone’s app (in the app, tap the three dots > Transfer accounts). 2) Disable 2FA on your Google account, re-enable it, and scan the new QR code with the new phone. The second is easier.

Is Google Authenticator safe from hackers? – It’s much safer than using only a password. However, it’s not phishing-proof – if you enter the code on a fake Google page, attackers can use it. That’s why security keys are recommended for high-risk users.

Why does the code change every 30 seconds? – It’s based on the current time and a shared secret. The 30-second window is a standard that reduces the chance of replay attacks.

Can I remove Google Authenticator later? – Yes. Go to your Google Security settings, find 2-Step Verification, and turn it off, or switch to a different authenticator app. You can also remove the specific device from the “Authenticator app” section.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →