Start with Google’s Security Checkup, make sure you can recover the account, then choose a phishing-resistant sign-in method that fits your devices. A strong setup reduces risk, but no single setting guarantees that an account cannot be compromised.
How do I make my Google Account more secure?
Work through the controls in this order. These steps are for personal Google Accounts; work or school accounts may have options controlled by an administrator.
As an Amazon Associate I earn from qualifying purchases.
- Open Security Checkup. Review Google’s personalized recommendations and act on the items it flags. Then open your Google Account’s Security & sign-in page to review recognized devices and sign-in methods. Recommendations and available options can differ by account.
- Confirm your recovery details. Add or update a recovery email you regularly use and a personal recovery phone number. Keep both accessible, and do not use Google Voice as the recovery phone: if your Google Account is locked, you may also lose access to the number. Google says recovery details and authentication changes can take up to seven days to take effect, and a newly added method may face additional trust checks. See Google’s recovery-options guidance.
- Choose your sign-in protection. Add a passkey, or enable 2-Step Verification if you want to sign in with a password plus a separate verification step. Where available, prefer a stronger second step than SMS; Google lists security keys as its most secure verification step. You can set up 2-Step Verification at Google Account 2-Step Verification.
- Use a unique password. Never reuse another site’s password for Google. A password manager can help create and keep track of strong, unique passwords. Google’s Password Checkup can identify weak, exposed or reused credentials saved to your Google Account.
- Reduce avoidable exposure. Remove apps and browser extensions you no longer need, avoid installing unknown apps or software from untrusted sources, and keep devices and software current using the device maker’s guidance. Treat urgent messages, calls and websites cautiously. Instead of following a suspicious link, go directly to your Google Account to check for alerts.
Passkeys and 2-Step Verification: what changes?
A passkey is a cryptographic sign-in credential stored on a device or supported credential service. You approve sign-in by unlocking the device with a fingerprint, face scan or screen-lock PIN; the passkey is not simply another password. Google describes it this way: “With passkeys, you can sign in to your Google Account with your fingerprint, face scan, or phone screen lock, like a PIN.” — Google Account Help.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Passkeys are designed to resist phishing better than passwords. They do not erase your existing sign-in factors. On an account with 2-Step Verification, Google says a passkey can replace the separate second step because it verifies possession of the device. That simplifies the sign-in flow, but it also means you should understand which devices or credential services hold your passkeys and maintain working recovery options.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Compatibility depends on operating-system and browser versions. Some cross-device sign-ins also depend on Bluetooth or support for synced credentials. If a passkey option does not appear, check Google’s passkey setup and compatibility guidance. Workspace accounts may have administrator restrictions.
When is a physical security key worth using?
A physical key is an optional way to add a possession-based sign-in factor. Google supports FIDO1 or FIDO2 security keys as a second step for 2-Step Verification. To create a passkey on a hardware key, the key must support FIDO2. Register the key with your account before relying on it; Google notes that a newly added key may take seven days to become available at sign-in.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose based on the devices you actually use, not just the connector listed on a package. Check USB-A versus USB-C, NFC support, operating-system and browser compatibility, portability, and whether you have a safe backup. Google recommends registering a primary and backup key. A backup helps avoid lockout if the primary is lost, but it should be stored separately and securely. Google’s instructions explain how to use a security key for 2-Step Verification.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWho should consider Advanced Protection?
Google positions Advanced Protection for people at elevated risk of targeted attacks, including journalists and activists. It requires a passkey or security key, limits third-party app access, applies stronger checks to suspicious downloads, and tightens account recovery. Enrollment is free; if you choose physical keys, you may need to buy them. Because the program makes recovery stricter and can limit app access, read Google’s Advanced Protection questions and requirements before enrolling, and make sure you have the required sign-in method ready.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What should I do if I think my account was compromised?
- Use Google’s account recovery page if you cannot sign in. Follow the prompts from a device and location you normally use when possible.
- After regaining access, follow Google’s steps to secure a hacked or compromised account. Review recent activity and account details, remove devices or changes you do not recognize, and revisit Security Checkup.
- Do not give your password or verification codes to a service claiming it can provide Google Account or password support. Google warns that it does not work with such services.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
