Google Account Security Checkup: A Step-by-Step Guide

To run a Google Account Security Checkup, open your own Google Account, go to Security & sign-in and start Security Checkup, then work through devices, sign-in protection, recovery info, linked apps, saved passwords and Gmail settings. Google's own help page says Security Checkup gives personalised recommendations, and that you should follow its security steps on a regular basis. This guide walks the same ground in plain English, says what each step protects against, and says what each one costs you. Menu names change over time, so where the exact path matters we describe it loosely and link Google's help page.

This is the security checkup: who can get into the account and how you get back in. Google also has a separate privacy checkup, covering things like activity controls, ad settings and location history. We cover it in a sister guide, the Google privacy checkup guide, and keep it out of this one. If your account is already taken over, skip ahead to Gmail hacked: what to do in the first hour.

Do this now: the 20-minute pass

1. Start from your account, not an email. Open your Google Account yourself and go to Security & sign-in. A message that urges you to "review your security" and carries its own button is a classic phishing shape.
2. Check Recommended actions. Google says an exclamation point in blue, yellow or red means a tip, an important step or an urgent notification, and a green shield means no immediate action is needed.
3. Review your devices and sign out of any you do not own or no longer use.
4. Review recent security activity for sign-ins or changes you did not make.
5. Turn on 2-Step Verification and consider a passkey on a device only you use.
6. Update recovery phone and email so you can always get back in.
7. Remove linked apps you no longer use, and check Sign in with Google links.
8. Run Password Checkup on your saved passwords.
9. Check Gmail for forwarding, filters and delegates you did not set up.

You can rehearse these choices in the Google Account Checkup Lab, a scenario with fictional people where nothing real is at stake.

1. Signed-in devices

Google's help page says you can see the computers, phones and other devices where you are, or recently were, signed in. You find them in your Google Account under Security & sign-in, in the devices panel, then Manage all devices. Select a device or session for details. Google explains that a session is a period of being signed in from a browser, app or service, and that it is normal to have several sessions on one device: a new device, re-entering your password, a new browser or app, granting an app access, or using a private window can each create one.

Google advises signing out on devices that are lost, that you no longer own or that do not belong to you. It also notes why a genuine entry can look wrong: you might have used a public computer, factory-reset a device, travelled through an airport, or the location shown might be a nearby place. The cost of signing out is small: you will sign back in on that device later. If you still do not recognise something, follow Google's steps to secure your account.

2. Recent security activity

The same Security & sign-in area has a panel of recent security events, which Google's hacked-account help describes as the place to check for suspicious activity. For each event you can say whether it was you. If it was not, Google's page says to select that and follow the steps on screen.

Google's page on at-risk sign-in methods adds a useful detail: if it suspects a sign-in method was added without your permission, it restricts the method, emails you a security alert and marks it at-risk. If you take no action, Google automatically removes it after 30 days. If you recognise it, you can re-enable it, but that needs a trusted passkey or security key. If you do not recognise it, remove it, change your password and review your settings for other suspicious activity.

3. 2-Step Verification and passkeys

Google says 2-Step Verification adds an extra layer in case your password is stolen. You can turn it on under Security & sign-in, in the "How you sign in to Google" section. Google recommends stronger second steps than text messages: its help page calls security keys the most secure verification step and Google prompts more secure than text codes, and says prompts can help protect against SIM swap and other phone-number-based hacks. For people at higher risk of targeted attacks, such as journalists and activists, Google points to its Advanced Protection Program.

Passkeys let you sign in with a fingerprint, face scan or phone screen lock instead of a password. Google says passkeys cannot be shared, copied, written down or accidentally given away, which makes them more secure against phishing, and that your biometric data stays on your device. The trade-offs are real, and Google states them:

• Creating a passkey opts you in to a passkey-first, password-less sign-in. You can change that default in your account settings.
• Only create passkeys on devices you personally own and use. Even after you sign out, anyone who can unlock the device can use the passkey to get in.
• A passkey bypasses the second step, because it already proves you hold your device.
• Google lists supported devices, browsers and operating system versions, so check the help page.

To see how passkeys work, try our Passkey Lab.

4. Recovery phone and email

Google says recovery info helps you get back into your account if you forget your password, if someone else uses your account, or if you are locked out for another reason. You can add or change a recovery phone and a recovery email under "How you sign in to Google". Google's advice is specific:

• Use a mobile phone that gets text messages, belongs only to you, and that you keep with you.
• Do not use a Google Voice number as the recovery phone. If you cannot sign in, the code would go to the account you are locked out of.
• Choose a recovery email you use regularly, but not the one you sign in with.
• Consider a recovery contact: someone you know well and trust. Google says they can help you get in but do not get your security alerts and notifications.

The catch is the delay. Google says a new recovery phone may take up to 7 days to take effect, and that codes may go to your previous info for 7 days after a change. The wait is deliberate: it gives you time to secure the account if someone else makes the change. A trusted passkey or security key may speed it up. You also cannot add recovery info while locked out, so do it now.

5. Linked apps and Sign in with Google

Google explains that you can give apps from other developers some access to your Google Account data, for example a photo editor that asks for your photos, and that you can review or remove them at any time on the linked apps page. It also says never to share your Google password with a third-party app, because the app would then have full access to your account.

• Remove access: select the app, then remove access. Google says the app can no longer reach your account, which may make some features unavailable.
• Sign in with Google: if you delete the link, Google stops automatic sign-in to that app. It does not delete your data on the app, but make sure you have another way to sign in first.
• Google's own page for the Security Checkup also lists "turn off access for linked apps that use less secure sign-in technology" as a step.

The cost is convenience: an app you remove will ask again if you want to use it. For most people, an app unused for years is access with no benefit.

6. Saved passwords and Password Checkup

If you save passwords in Google Password Manager, Chrome's help page says you can check all of them at once for passwords exposed in a data breach and ones that are weak and easy to guess. On a computer, you open Chrome's Google Password Manager and select Checkup. Chrome can also warn you when a password was compromised in a data breach, as long as Safe Browsing is on.

When Checkup flags a password, change it on that site, and make each one unique. Start with your email, because password reset links go there, then money accounts. Passwords you save only on a device, rather than to your Google Account, are managed differently, so read the help page for your platform.

7. Gmail settings that matter

A thief who reaches your inbox often wants to stay there quietly. Three Gmail settings are worth a look, all in Gmail's settings on a computer:

• Forwarding. Google says automatic forwarding sends new messages to another address. If you see a forwarding notice but never set it up, change your password immediately, because someone else might have access, then turn forwarding off in Gmail settings.
• Filters. Filters can forward messages or archive them automatically. Google's forwarding page shows that a filter can send chosen messages to another address, and says you get a notice in your inbox for the first week after one is created. A filter you did not create deserves removal.
• Delegates. Google says a delegate can read, send and delete mail in your account on your behalf. A delegate cannot chat or change your password. Delegates are added from Gmail on a computer, after a check that it is really you, so an unknown one is a warning sign. Remove it under the "Grant access to your account" section.

The cost of switching off forwarding is that mail will no longer arrive at the other address, so check that you really do not need it. For what to do if any of this turns out to be a takeover, see Gmail hacked: what to do in the first hour.

8. "Security issues found" and recommended actions

Google's help page says it may use coloured icons to recommend action on your account, and describes the coloured exclamation points under Recommended actions, which lead to Security Checkup. Read each prompt before you clear it. Some are a quick tip; some, such as a flagged sign-in method or a compromised password, are worth acting on straight away. Never act on a prompt that reached you only through an email or text link: open your account yourself and see whether the same item appears there.

How to tell your account is in good shape

• Security & sign-in shows a green shield and no open recommendations.
• The device list shows only devices you own or recognise.
• 2-Step Verification is on, preferably with a passkey or security key.
• Your recovery phone is one you hold, and your recovery email is not your sign-in address.
• Linked apps are limited to ones you still use.
• Password Checkup shows no exposed or weak passwords.
• Gmail shows no forwarding, filter or delegate you did not set up.

Prevent it next time: a checklist

• Repeat the checkup every few months and after losing a phone or changing a number.
• Reach your account settings through your own bookmark or the app, never through a link in a message.
• Prefer a passkey, security key or Google prompts over text codes, on devices only you use.
• Keep one recovery phone and one recovery email that you actually control.
• Give an app the smallest access it needs, and remove it when you stop using it.
• Use a unique password for every site, starting with email.
• See what is publicly findable about you with the Digital Footprint Check.

Frequently asked questions

How do I run a Google Account Security Checkup?

Open your own Google Account in a browser or app, go to Security & sign-in and start Security Checkup. Google's help page also says to use Recommended actions from your profile picture, which leads to Security Checkup with personal recommendations. Start from your account, not from a link in an email.

How often should I do it?

Google says to follow its security steps on a regular basis. A sensible rhythm is every few months, and after losing a phone, changing a number or noticing a security alert.

What does a green shield mean?

Google says a green shield with a check mark means your account is healthy and no immediate action is needed. Colour-coded exclamation points mean it has recommendations: blue for tips, yellow for important steps and red for urgent notifications.

Is a passkey better than 2-Step Verification?

They work together. Google says passkeys are a simple and secure alternative to passwords and are more secure against phishing, and that a passkey sign-in bypasses the second step because it already proves you hold your device. Google also warns to create passkeys only on devices you personally own, because anyone who can unlock that device can use them.

Why is there a seven-day wait when I change recovery info?

Google says a new recovery phone number may take up to 7 days to take effect, so that if someone tries to use your account without permission you have time to secure it. If you have a trusted passkey or security key you may be able to speed this up.

What if I find forwarding or a device I did not set up?

Treat it as a warning sign. Google says to change your password immediately and turn off forwarding, and to sign out of devices you do not recognise. For a full takeover, follow our Gmail hacked guide and Google's steps for a compromised account.

Sources

• Google Account Help: Make your account more secure
• Google Account Help: See devices with account access
• Google Account Help: Turn on 2-Step Verification
• Google Account Help: Sign in with a passkey instead of a password
• Google Account Help: Set up recovery options
• Google Account Help: Manage at-risk or new sign-in methods on your Google Account
• Google Account Help: Manage links between your Google Account and apps from other developers
• Google Account Help: Share some access to your Google Account data with apps from other developers
• Google Account Help: Secure a hacked or compromised Google Account
• Google Chrome Help: Manage passwords in Chrome
• Gmail Help: Automatically forward Gmail messages to another account
• Gmail Help: Delegate and collaborate on email

This is general guidance. Google's menus and wording change; follow the official pages above for the current steps.