How to Check Your Google Account Security in 10 Minutes in the UK

Your Google account holds more than your email. It holds your photos, your documents, your saved passwords, your YouTube history and, for many people, the keys to their banking and shopping accounts. If someone gets in, they get all of it at once, which is why a quick security check is worth ten minutes of your time. Google has a built-in tool that walks you through the whole thing, and you can do it from your phone or computer without installing anything. Here is how to run it properly.

Step 1: Open the Security Checkup

Start by signing in to your Google account, then go to myaccount.google.com and tap Security in the menu. Near the top you will see Security Checkup, with a button to start it. You can also search for "Google Security Checkup" and follow the first result from google.com. The checkup scans your account and shows a list of issues, each with a fix button next to it. Work through them one by one, starting with anything marked in red or amber.

The checkup is not a one-off job. Google recommends running it every few months, and it is worth doing after any security scare, such as a strange login alert or a data breach in the news. Set a reminder on your phone so you do not forget.

Step 2: Check your password and turn on 2-Step Verification

The first thing the checkup looks at is your password. If it is weak, reused on other sites, or has appeared in a known data breach, Google will say so and prompt you to change it. Pick a long password you do not use anywhere else. A passphrase made of three or four random words is easier to remember than a jumble of symbols and harder to guess. If you struggle to remember passwords, use a password manager rather than reusing one password everywhere.

Next, make sure 2-Step Verification is switched on. You will find it in the Security section under "How you sign in to Google". With it on, signing in from a new device needs a second step, usually a code sent to your phone or a prompt on a device you already own. This one setting blocks the vast majority of account takeovers, because a stolen password alone is no longer enough. If you see the option to use a passkey instead, take it. A passkey lets you sign in with your fingerprint, face or PIN, and it cannot be phished in the way a password can.

Step 3: Review the devices signed in to your account

Scroll down to "Your devices" in the Security section. Google lists every phone, tablet and computer that is currently signed in to your account, along with where and when each one was last active. Look through the list carefully. Your own devices should all be there, but if you see a device you do not recognise, or a location you have never been, tap it and choose Sign out.

It is normal to see old devices you no longer use, such as a phone you sold or a laptop you replaced. Sign those out too. Every device left signed in is a door into your account, and there is no reason to leave doors open that you no longer need. If you sign out a device by mistake, you can simply sign back in.

Step 4: Check third-party access and connected apps

Still in the Security section, look for "Third-party access". This lists every app and website you have given permission to access your Google account, such as a fitness app that reads your calendar or a website you signed into with Google. Many of these permissions were granted years ago and forgotten about, and some belong to services you no longer use.

Tap each entry you do not recognise or no longer need and choose Remove access. The app will stop being able to read your Google data, and you can always grant access again later if you need it. Pay special attention to apps with access to your Gmail or Google Drive, since those hold your most sensitive information. A quick tidy-up here closes off access you may have forgotten you ever gave.

Step 5: Check your recovery information

The last step is the one people skip, and it matters most when things go wrong. In the Security section, check your recovery phone number and recovery email address. These are what Google uses to confirm it is really you if you ever get locked out, so they need to be current. If you changed your phone number recently, update it now, while you can still sign in without any trouble.

Also check that the recovery email belongs to an account you can still access, ideally one that is not the Google account itself. A recovery email on the same account is no help if you lose access to that account. Once your recovery details are up to date, run through the Security Checkup one more time to confirm everything is green. The whole process should take about ten minutes, and your account will be far harder to break into than it was before you started.

Frequently Asked Questions

How often should I run the Google Security Checkup?

Every few months is a good habit, and always after a security alert, a data breach in the news, or a change of phone or computer. The checkup takes about ten minutes and flags new issues, such as a password that has appeared in a breach since your last check.

Is 2-Step Verification really necessary if I have a strong password?

Yes. Even a strong password can be stolen through phishing, a data breach or malware on your device. With 2-Step Verification on, an attacker who has your password still cannot sign in without your phone or security key. It is the single most effective step you can take.

What should I do if I see a device I do not recognise?

Sign it out immediately from the "Your devices" section, then change your password and check your recent account activity for anything unusual. If you find emails you did not send or settings you did not change, use Google's account recovery help to secure the account and review your other accounts that share the same password.