Set up 2-Step Verification

Protect your business with 2-Step Verification

These articles are for G Suite administrators. G Suite users should go to Turn on 2-Step Verification.

Use 2-Step Verification to protect accounts from unauthorized access. 2-Step Verification puts an extra barrier between your business and cybercriminals who try to steal usernames and passwords to access business data. Turning on 2-Step Verification is the single most important action you can take to protect your business.

What is 2-Step Verification?

With 2-Step Verification (also known as two-factor authentication), your users sign in to their account in two steps using:

Step 1: Something they know (their password)

Step 2: Something they have (such as a physical key or access code delivered to their phone)

Do small businesses need 2-Step Verification?

Cybercriminals target businesses of all sizes. If a hacker gets into your administrator account, they can see your email, documents, spreadsheets, financial records, and more.

A hacker could steal or guess a password, but they can’t reproduce something only you have.

2-Step Verification methods

When you set up 2-Step Verification, you choose the second verification step for your users.

Open all  |   Close all

Security keys
Security keys are the most secure form of 2-Step Verification and protect against phishing threats. Types of security keys:

When a user signs in to their Google Account, their device detects that the account has a security key. For the second verification step, the user signs in with their security key. Users connect their security key to their device by USB, Bluetooth, or NFC (Near Field Communication), depending on the type of key. Learn more about security keys

Google prompt
Users can set up their Android or Apple mobile devices to receive a sign-in prompt. When they sign in to their Google Account on their computer, they get a "Trying to sign in?" prompt on their mobile device. They simply confirm by tapping their mobile device. Signing in this way adds the security of 2-Step Verification and is quicker than entering a verification code. Learn more about phone prompts
Google Authenticator and other verification code generators
Users generate one-time verification codes on a hardware token (small hardware device) or an app on their mobile device, such as Google Authenticator. The user enters the code to sign in to their computer and other devices, including the mobile device itself. Google Authenticator and other apps don't need an internet connection to generate codes.
2-Step Verification supports software and hardware tokens that use the TOTP (Time-based One Time Password) standard.
Backup codes
If a user doesn't have their mobile device or works in an area where they can't carry mobile devices, they can use backup codes for 2-Step Verification. Users can generate backup verification codes and print them ahead of time.
Text message or phone call

Google sends a 2-Step Verification code to mobile devices in a text message or voice call.

Best practices for 2-Step Verification

Enforce 2-Step Verification for administrators and key users
You can make 2-Step Verification optional or required for your users. We recommend enforcing 2-Step Verification for your administrator account and users who work with your most important business information.
  • The administrator account is the most powerful account because it can delete users, reset passwords, and access all your data.
  • Users who work with sensitive data such as financial records and employee information should also use 2-Step Verification.
Consider using security keys in your business
Because security keys are the strongest 2-Step Verification method, consider using them in your business.
  • Security keys—The strongest 2-Step Verification method, and they don’t require users to enter codes. You can buy compatible security keys from a retailer you trust, or Titan Security Keys from the Google Store. Or your users can use their phone's built-in security key (available on phones running Android 7+ or iOS 10+).
  • Alternatives to security keys—If you decide not to use security keys, Google prompt or the Google Authenticator app are good alternatives. Google prompt provides a better user experience because users simply tap their device when prompted instead of entering a verification code.
  • Text messages are discouraged—They rely on external carrier networks and might be intercepted.

What's next?

Was this helpful?
How can we improve it?