The most effective way to secure an email account is to make a stolen password insufficient for sign-in. Enable multi-factor authentication (MFA), prefer a phishing-resistant passkey or security key when your provider supports it, and set recovery methods that do not depend on the same phone or inbox you could lose. Then generate offline backup codes and inspect forwarding, filters, applications, and recent activity for changes you did not make.
The exact labels differ between providers and editions. Personal accounts and employer- or school-managed accounts can also have different choices, so use your provider’s current security page and follow your organization’s policy where applicable.
As an Amazon Associate I earn from qualifying purchases.
What a secure email-account setup includes
Email is a high-value account because it can receive password-reset links for many other services. A practical setup has four separate layers:
- A primary sign-in factor: a password, passkey, or both, depending on the provider.
- A second factor: a security key, passkey, authenticator app, provider prompt, or another method required after the primary factor.
- Independent recovery: a recovery email and phone number that you can access without relying on the email inbox currently being protected.
- Offline fallback and monitoring: backup codes, a spare registered device or key, recent-activity checks, and review of account access rules.
MFA is worth enabling even if you believe your password is strong. The Cybersecurity and Infrastructure Security Agency (CISA) advises enabling MFA for email and explains that it can block many common attacks when credentials have already been compromised. Its business guidance puts security keys first, followed by authenticator-app methods, with text-message and email codes at the weaker end of the listed methods. Treat that as a useful security ordering, not a guarantee that every provider implements each method identically.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Compare MFA and passkey choices
Choose the strongest method you can use reliably, and configure at least one fallback before you depend on a single phone or key. The trade-offs below combine CISA’s ordering with Google’s descriptions of its personal-account options.
| Method | Phishing resistance | What you need | Recovery consideration | Everyday use |
|---|---|---|---|---|
| FIDO2 hardware security key | Strong; CISA places security keys at the top of its listed methods | A compatible physical key and a supported connector or wireless connection | Register a backup key or another factor before the primary key is lost | Insert, tap, or otherwise approve the key when prompted |
| Passkey | Strong; Google says passkeys are resistant to phishing | A compatible device or credential manager, unlocked with a fingerprint, face scan, or device screen lock | Keep another passkey, security key, device, or backup method available | Unlock the device locally instead of typing a password in many sign-ins |
| Authenticator-app code | Stronger than SMS or email codes in CISA’s ordering, but still depends on protecting the app and device | An authenticator app enrolled with the account | Have a second enrolled device or another recovery method if the phone is unavailable | Type a time-based code from the app |
| Provider prompt | Depends on the provider’s implementation and the device receiving the prompt | A signed-in phone or other approved device | Keep another registered device or factor | Approve or deny a notification |
| SMS or voice code | Weaker; Google warns that SMS and calls can be vulnerable to phone-number-based attacks | Access to the registered phone number | Number loss, SIM changes, or carrier problems can block access | Type a code sent by text or read over a call |
| Email code | Weaker when the code is sent to another email account that could itself be compromised | Access to the separate email account | Protect the recovery mailbox with its own MFA and independent recovery | Retrieve and enter a code from the other inbox |
A passkey is a credential associated with a device or credential manager and unlocked locally with a biometric check or device PIN. Google says passkeys use public-key standards associated with the FIDO Alliance and W3C and are resistant to phishing. Some Google accounts can make passkey-first sign-in the default; check the account’s sign-in preference if you still want a password prompt or another method to appear first. A passkey improves sign-in security, but it does not eliminate the need for recovery settings.
Set up MFA, passkeys, and recovery step by step
1. Open the official security page
Sign in through your email provider’s official account page, then open its security or sign-in settings. For a Google Account, the relevant area is Security, followed by How you sign in to Google. Interface names can change, so follow the current labels shown by the provider rather than a screenshot from an older guide.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If the account belongs to an employer or school, check the organization’s instructions first. Microsoft states that an administrator must enable MFA for Microsoft 365 work or school accounts before users can configure it. Administrators can also require or disable particular methods.
2. Turn on MFA
- Open the provider’s MFA, two-step verification, or multi-factor authentication setting.
- Confirm your identity using the provider’s existing sign-in checks.
- Choose the strongest method offered that you can use consistently. Prefer a passkey or hardware security key where supported; otherwise use an authenticator app or provider prompt before relying on SMS, voice, or email codes.
- Complete a test sign-in in a separate browser window or on another device while your current session remains available. Confirm that the second factor is requested and that you can approve it.
Google’s personal-account documentation lists passkeys and hardware security keys, Google prompts, authenticator codes, and SMS or call codes as possible two-step methods. Your account may show fewer choices because of device compatibility, location, account type, or administrator policy.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Add a passkey or hardware security key
In the provider’s passkey or security-key section, follow the enrollment prompts. A passkey normally asks you to verify with the device’s fingerprint, face scan, or screen lock. A hardware key may require a USB, NFC, or Bluetooth connection, depending on the key and device.
- Check that the key’s connector or wireless mode works with every device you expect to use.
- Register a second key or another factor before removing your only existing method.
- Do not assume a FIDO2 key works with every account, browser, operating system, or connector. Verify compatibility in the provider’s current instructions.
- A physical key is optional, not a requirement. It is useful for people who want a phishing-resistant factor that is separate from their phone.
CISA names YubiKey as an example of a security key, while Google documents hardware security keys as a second-step option. Those references do not mean every model works with every provider.
4. Add independent recovery information
Set a recovery email that you check regularly and that is different from the address used to sign in. Google Account Help describes a recovery email as a way to get back into an account and receive security notifications. Protect that recovery mailbox with MFA and its own recovery options.
Add a current phone number if your provider supports it, but do not make a phone number your only route back in. Google warns that changes to recovery information can take up to seven days to take effect. A newly added address or number therefore may not be immediately usable for every recovery or security action.
5. Generate and store backup codes
- Open the provider’s backup-code or emergency-code setting in the MFA section.
- Generate a new set and save it in a secure location separate from the device used for everyday sign-in.
- Keep the codes private. Do not send them to anyone who contacts you by email, phone, text, or chat.
- After using a code, mark it inactive. Google says a used backup code no longer works and that generating a new set can replace the old set.
Useful storage options include a password manager’s protected notes area or a securely stored printed copy. The right choice is the one you can reach if your usual phone is lost, damaged, or unavailable.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
6. Review access and account rules
Open recent activity, signed-in devices, authorized applications, and the list of recovery methods. In Gmail, inspect forwarding addresses, filters, mail delegation, and account permissions. Remove any rule or access grant you did not create. An attacker can preserve access by forwarding messages or hiding warning emails even after you change a password.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Google account details that matter
Google’s two-step verification settings can contain several methods at once. You can retain an authenticator app or phone prompt as a fallback while using a passkey or security key as the preferred method. Review the account’s sign-in preference after adding a passkey because Google may make passkey-first sign-in the default.
For account recovery, Google recommends using a familiar device, browser, and location when you attempt to regain access to a personal account. It also warns that it does not work with third-party account-recovery services. Do not disclose your password, backup code, or verification code to a person claiming to be support.
Google’s recovery and authentication changes can be subject to a waiting period of up to seven days. Trusted passkeys or security keys may help establish trust for some changes, but no universal recovery time should be assumed.
What to do if you lose your phone or sign-in device
Use the fallback you prepared before the loss, rather than trying random codes or unverified recovery services.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Try another registered passkey, security key, authenticator device, provider prompt device, or phone number.
- Use one of your unused backup codes.
- Start the provider’s official account-recovery flow from a familiar device, browser, and location when possible.
- Follow the identity checks exactly. Do not repeatedly change recovery details while a recovery request is pending.
- After regaining access, remove the lost device, revoke its sessions, replace compromised recovery information, and generate a fresh set of backup codes.
If your only second factor was an SMS number, contact the mobile carrier promptly about a lost phone or suspected SIM takeover. If the phone may have been stolen, change the email password from a trusted device and review account activity as soon as possible.
Respond to signs that the account was compromised
Warning signs include an unfamiliar sign-in alert, a password-reset message you did not request, new forwarding or filtering rules, an unknown delegated mailbox user, unexpected sent mail, or an application you do not recognize.
- Use the provider’s official security page and change the password or reset the sign-in credential. Do this from a trusted device.
- End sessions and remove devices you do not recognize.
- Delete unfamiliar forwarding addresses, filters, delegates, connected applications, and recovery methods.
- Re-enroll MFA if a phone, authenticator, passkey, or security key may have been exposed. Add a backup before removing the old factor.
- Check messages sent during the suspected compromise and warn contacts about malicious mail they may have received.
- Inspect password-reset activity for other services that use this address, then secure those accounts independently.
For Gmail specifically, Google’s security guidance calls out forwarding, filters, mail delegation, account permissions, and other access routes as items to check. A password change alone is not enough if an attacker left one of these routes active.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep the setup usable over time
- Test a fallback method periodically, without consuming a backup code unnecessarily.
- Replace an old phone number, recovery address, device, or security key as soon as it stops being under your control.
- Keep at least one recovery method independent of the inbox being protected.
- Run the provider’s security review after changing devices, traveling, or responding to a suspicious alert.
- Never approve an unexpected MFA prompt. Repeated prompts can indicate that someone already has your password.
- Use the provider’s official pages instead of links in unsolicited messages.
Account security is different from email-domain security
MFA, passkeys, recovery settings, and account reviews protect an individual mailbox’s sign-in. They do not configure authentication for an entire sending domain. NIST’s 2019 publication Trustworthy Email (SP 800-177 Rev. 1) discusses system-level technologies such as SPF, DKIM, DMARC, TLS, and content protection. Those controls matter to domain owners and administrators, but they are not substitutes for securing your personal account with MFA and recovery options.
Free tools Windows power users keep installed
One-click scans. No signup required.
When a hardware security key is worth considering
A physical FIDO2 security key is a sensible optional choice if you want a phishing-resistant factor that does not depend on a phone battery, cellular service, or an authenticator-app backup. It can be especially useful for administrators, journalists, people targeted by account takeover, or anyone who regularly signs in from multiple devices.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Before buying or enrolling one, confirm the provider supports security keys, check the key’s USB, NFC, or Bluetooth compatibility with your devices, and arrange a backup key or alternate factor. Do not treat any particular product as universally compatible or as a replacement for recovery planning.
Frequently Asked Questions
Are text-message MFA codes better than having no MFA?
Yes. A text or voice code adds a barrier that a stolen password alone does not provide. However, CISA places these methods below security keys and authenticator-app methods, and Google warns that phone-number-based attacks can affect SMS and calls. Use a stronger method when your provider and devices support it.
Can a passkey replace recovery settings?
No. A passkey protects normal sign-in, but losing the device or credential-manager access can still leave you locked out. Keep another passkey, security key, registered device, authenticator method, or backup codes.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat should I do if someone asks for my backup code?
Do not provide it. Backup codes are private credentials. Close the conversation and use the provider’s official security or recovery page instead.
Why should my recovery email be different from my sign-in email?
A separate recovery address remains reachable if the primary inbox is locked, compromised, or unavailable. Google specifically recommends a recovery email different from the address used to sign in.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
