What you control in a Google account

A Google account is the single key to many services: Gmail, Google Drive, Google Photos, YouTube, and Android phones all use the same login. This means one account controls a lot of your digital life, and one compromised password puts all of it at risk. The good news is that Google gives you direct control over what's connected, who can access it, and what data gets stored where.

Start by understanding what "your Google account" actually includes. It's not just email — it's a collection of services and settings that all use the same username and password. When you sign into Gmail, you're signing into the same account you use for YouTube. When you back up your phone photos to Google Photos, that's the same account. This is convenient until something goes wrong, which is why managing it means knowing what's plugged in and what isn't.

Key Takeaways

  • Your Google account password controls access to Gmail, Drive, Photos, YouTube, and any Android phone signed in with that account — so a strong, unique password matters more than for most accounts.
  • Two-factor authentication (a second code sent to your phone or generated by an app) stops someone from accessing your account even if they have your password.
  • The Security Checkup tool at myaccount.google.com shows you every device signed in, every app with access to your account, and recent login activity in one place.
  • You can remove old devices, revoke access from apps you no longer use, and see exactly where your account has been accessed from and when.
  • Recovery options (a backup email address and phone number) let you regain access if you forget your password or someone locks you out.

Setting up two-factor authentication on your Google account

Two-factor authentication means Google asks for a second proof of identity after you enter your password. This second factor is usually a code sent to your phone via text message, or a code generated by an authenticator app like Google Authenticator or Authy. Even if someone steals your password, they cannot sign in without this second code.

To turn it on, go to myaccount.google.com, click "Security" in the left menu, and scroll to "How you sign in to Google." Click "2-Step Verification" and follow the prompts. Google will ask you to enter your password, then choose how you want to receive the second code — usually a text message to your phone. You'll get a test code to confirm it works. After that, every time you sign in from a new device, Google sends a code to your phone. You enter it, and you're in.

The trade-off is a few extra seconds each time you sign in from a new device. On devices you use every day, Google remembers you after the first time, so you won't see the prompt again for 30 days. If you lose access to the phone number you registered, Google lets you use backup codes — a list of one-time codes you should write down and store somewhere safe, separate from your phone.

Reviewing devices and apps with access to your account

Every device you've ever signed into your Google account on is still listed somewhere, and every app you've given permission to read your Gmail or access your Drive is still connected. Most of these are fine. Some are old phones you no longer own. Some are apps you installed once and forgot about. The Security Checkup tool shows you all of them in one place.

Go to myaccount.google.com and click "Security." Under "Your devices," you'll see every phone, tablet, and computer currently signed in. Click on any device to see when it last accessed your account. If you see a device you don't recognize, or a phone you sold years ago, click it and select "Sign out" or "Remove." This when ready disconnects that device from your account.

Next, look at "Third-party apps with account access" in the same Security section. This shows every app or website you've given permission to read your email, access your calendar, or upload files to your Drive. Many of these are legitimate — your email client, your calendar app, your backup service. But if you see something you don't use anymore, click it and select "Remove access." The app can no longer read your data.

Creating strong passwords and recovery options

Your Google password should be long, random, and unique — meaning you don't use it anywhere else. If a website you use gets hacked and your password leaks, hackers will try that same password on Gmail, your bank, and everywhere else. A unique password means they can't.

A strong password is at least 12 characters long and mixes uppercase letters, lowercase letters, numbers, and symbols. "Tr0pic@lSunset42" is stronger than "password123." The easiest way to manage unique passwords for every account is to use a password manager — a tool like Bitwarden, 1Password, or Dashlane that stores all your passwords encrypted and fills them in for you. Google's own password manager is built into Chrome and Android, and it works well if you're already in the Google ecosystem.

Go to myaccount.google.com, click "Security," and look for "How you can recover your account." Add a recovery email address (a different email account you control) and a recovery phone number. If you forget your password or someone locks you out, Google uses these to confirm you're really you and let you back in. Without them, you may lose access to your account permanently.

Checking recent activity and suspicious sign-ins

Google keeps a log of every time your account was accessed and where. You can see this log and spot suspicious activity — someone signing in from a country you've never visited, or at a time you were asleep. Go to myaccount.google.com, click "Security," and scroll to "Your recent security events." This shows the last few times your account was accessed, what device was used, and where it was signed in from.

If you see a sign-in you don't recognize, click it and tell Google "This wasn't me." Google will ask you to change your password when ready and will sign out all other devices. This stops the intruder from accessing your account further. If you see multiple suspicious sign-ins, change your password right away, turn on two-factor authentication if you haven't already, and review which apps have access to your account.

Google also sends you email alerts if your account is accessed from a new device or location. These emails go to your primary Gmail address. If you get an alert for a sign-in you didn't make, don't ignore it — click the link in the email, confirm it wasn't you, and change your password.

Managing data storage and backups

Your Google account comes with 15 gigabytes of free storage shared across Gmail, Drive, and Photos. Once you hit that limit, you have to pay for more storage or delete files. You can see how much you're using by going to one.google.com and looking at the storage meter at the bottom left.

If you're running out of space, the fastest way to free it up is usually to delete old emails or large files from Drive. You can also turn off automatic photo backup in Google Photos if you're not using it. Go to the Photos app on your phone, tap your profile picture, then "Photos settings," and toggle off "Backup and sync." Your existing photos stay in Google Photos, but new photos won't upload automatically.

If you want to read all your data from Google before deleting it, use Google Takeout at takeout.google.com. This tool lets you read your Gmail, Drive files, Photos, YouTube history, and more as a backup. It can take hours or days depending on how much data you have, and Google emails you a read link when it's ready.

Signing out of your account on shared or public devices

If you sign into your Google account on a shared computer, a library computer, or a friend's phone, always sign out when you're done. Signing out removes your account from that device and stops anyone else from accessing your email or files.

On a computer, click your profile picture in the top right corner of Gmail or any Google service and select "Sign out." On a phone, go to Settings, scroll to "Google," tap your account name, then "Manage your Google Account," go to the "Security" tab, and scroll down to "Your devices." Find the device you want to sign out of and select "Sign out."

If you forgot to sign out and you're worried someone accessed your account, go to myaccount.google.com, click "Security," and under "Your devices," sign out all devices except the one you're currently using. This forces anyone else to sign back in with your password, which they can't do if you've changed it.

Frequently Asked Questions

What should I do if I think someone has my Google password?

Change your password when ready at myaccount.google.com. Then go to the Security section, review "Your devices" and remove anything you don't recognize, and check "Third-party apps with account access" to revoke any apps you don't use. If you see suspicious recent activity, tell Google "This wasn't me" on each sign-in. Turn on two-factor authentication if you haven't already.

Can I have more than one Google account?

Yes. You can create multiple Google accounts with different email addresses and manage them separately. On Android phones and in Chrome, you can sign in with multiple accounts at once and switch between them. Each account has its own password, storage, and security settings. This is useful if you want to keep work email separate from personal email.

What happens if I forget my Google password?

Go to accounts.google.com/signin/recovery and enter your email address. Google will ask you to verify your identity using your recovery phone number or recovery email address. If you have both set up, you can choose which one to use. Google sends a code to that phone or email, you enter it, and then you can create a new password.

Do I need to use Google's password manager, or can I use a different one?

You can use any password manager you trust. Popular options include Bitwarden, 1Password, Dashlane, and LastPass. The main advantage of Google's built-in password manager is that it's already there and syncs across your devices. The main advantage of a third-party manager is that it works with all your accounts, not just Google services.

Can I delete my Google account?

Yes, but it's permanent and affects everything connected to it — Gmail, Drive, Photos, YouTube, and Android devices all lose access. Before you delete, read your data using Google Takeout if you want to keep anything. Go to myaccount.google.com, click "Data & privacy," scroll to "Delete your Google Account," and follow the steps. Google asks you to confirm your password and gives you a 30-day window to change your mind.