Start with Google’s Security Checkup, then strengthen sign-in, confirm you can recover the account, and remove access you no longer trust. If you think someone has already gotten in, use Google’s compromised-account recovery process and review the account from a device you trust.
Start with Google Security Checkup
Sign in to your Google Account and open Security Checkup. Follow the recommendations shown for your account. Google may prompt you to review recovery options, passkeys, 2-Step Verification, connected apps, device screen locks, or Play Protect. A green shield means the page has no immediate recommendations; it is still worth checking the settings listed there.
As an Amazon Associate I earn from qualifying purchases.
Also review recent security activity and the devices signed in to your account. If you see a sign-in, device, or change you do not recognize, treat it as a possible compromise rather than dismissing it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Make sign-in harder to steal
A password alone can be phished or exposed in a breach elsewhere. A passkey or a strong second step adds protection even if someone learns your password.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use a passkey when it fits your devices
A Google Account passkey lets you sign in using your device’s fingerprint, face scan, or screen lock instead of typing a password. Google says passkeys are designed to resist phishing. For accounts using 2-Step Verification or Advanced Protection, a passkey also satisfies the second-step requirement. See Google’s passkey sign-in guidance and create one from your account’s security settings.
Set up passkeys only on devices you control and protect with a screen lock. Keep another secure sign-in or recovery method available in case a device is lost or replaced.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Turn on 2-Step Verification if you use a password
Go to 2-Step Verification in your Google Account settings and follow the prompts. Google recommends Google Prompts if you are not using a passkey; a security key is its strongest second-step option. An authenticator app can generate codes without an internet connection. SMS or phone-call codes are better than password-only sign-in, but they are more vulnerable to phone-number-based attacks such as SIM swapping.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Backup codes can help if your phone is unavailable. Store them somewhere private and secure, and never share them with someone who contacts you. Google says backup codes are not available to Advanced Protection users.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Keep recovery options current and review connected apps
At Google Account recovery settings, check that your recovery email and phone number are current and that you can access them. Google can use these details to help restore access and alert you to suspicious activity. A recovery address should itself be secured, ideally with a unique password and strong sign-in protection.
Google notes that changes to authentication or recovery factors may take up to seven days to take effect in some cases; this is not a universal waiting period for every account change. If you already have a trusted passkey or security key, Google says it may be possible to accelerate some changes. See Google’s guidance on sign-in and recovery method restrictions.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
In Security Checkup, review apps and services with access to your Google Account. Remove access for anything unfamiliar or no longer needed. An app’s access can expose account data even when it does not know your Google password.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUse a unique password and reduce device exposure
If you sign in with a password, make it long and unique to your Google Account. Reusing a password means a breach at another site could put your Google sign-in at risk too. A password manager can help create and store distinct passwords. Google’s Password Checkup can flag weak, exposed, or reused passwords saved in your account.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Remove browser extensions and apps you do not need, especially on devices used for sensitive work. Keep your operating system, browser, and security protections up to date, and use a screen lock on phones and computers that can access your account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Consider Advanced Protection if you face targeted attacks
Google’s Advanced Protection Program is intended for people at elevated risk of targeted online attacks, including journalists, activists, political campaign staff, business leaders, and IT administrators. It requires a passkey or security key when signing in on new devices, restricts some third-party app access, and applies stronger checks to suspicious downloads.
The program is free, although you may need to buy a hardware security key. Google recommends having a primary key and a backup if you choose keys. Some apps or services may not work with an Advanced Protection account, and account recovery can be more involved. Read Google’s Advanced Protection FAQ before enrolling so you understand the recovery and compatibility trade-offs.
If you think your Google Account has been hacked
Use Google’s compromised-account instructions. If you cannot sign in, begin with Google Account recovery and answer the prompts as accurately as possible. Use a device and location you have previously used to sign in when you can.
- Regain access through Google. Do not give your password or verification codes to anyone offering to recover the account. Google says it does not work with account- or password-recovery services.
- Secure sign-in. Change a compromised password to a strong password you have never used elsewhere, then set up a passkey or 2-Step Verification.
- Check activity and account settings. Review recent security activity, signed-in devices, recovery details, and any changes you did not make.
- Remove unfamiliar access. Sign out devices you do not recognize and revoke access for apps you do not trust or use.
- Check for wider exposure. If the affected device may contain malware, scan it and remove suspicious software before using it for sensitive sign-ins. If the account held financial or identity information, review relevant accounts and records for unauthorized activity.
Google’s account recovery guidance and compromised-account instructions explain the official steps and what to check after regaining access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
