Google Account Safety: The Complete 2026 Checklist
Everything you should turn on to protect your Google account — passkeys, recovery options, security checkup, and advanced protection.
Table of contents
Your Google account holds your email, photos, contacts, purchases, and often your identity for a dozen other services. Locking it down is the highest-leverage twenty minutes you can spend online. Here is exactly what to do.
Run the Security Checkup
Go to myaccount.google.com/security-checkup. Google walks you through recent security events, connected devices, third-party app access, and sign-in method health. Fix anything flagged in yellow or red before continuing.
Set up a passkey
Passkeys replace passwords with a secure, phishing-resistant key stored on your device. Under Security, choose 'Create a passkey' and follow the prompts. Add a passkey on every device you regularly use.
Two-step verification
Even with a passkey, keep two-step verification enabled as a fallback. Choose an authenticator app or hardware key over SMS. Save the backup codes somewhere safe — a password manager works well.
Recovery email and phone
Add a recovery email you can access and a phone number you actually own. Update them the moment either changes. Without accurate recovery information, regaining access to a locked account is extremely difficult.
Review third-party app access
Under Security, third-party apps with account access, revoke anything you no longer use. Old integrations are the most common cause of unexpected data exposure.
Advanced Protection Program
If you handle sensitive information — journalists, activists, executives — enable the Advanced Protection Program. It enforces hardware-based two-step verification and adds extra checks against phishing and malicious downloads.
When something feels off
If you get a security alert you do not recognize, follow the link from myaccount.google.com — never from the email itself. Change your password, sign out of every session, and run the Security Checkup again. See our Play safety tips for the phishing patterns to watch for.
Follow this checklist once and revisit it every six months — that is enough to stay ahead of most attacks.
Read more guidesAlex writes about Android, Google Play, and consumer digital safety. Every guide on this site is researched, reviewed, and updated regularly.