Stillcode › Two-factor authentication › Google Account
Google Account publishes software of its own for this and also takes an open authenticator code. What choosing either one commits you to, and what happens when the phone holding those codes is gone.
These are the second factors Google Account offers on drive.google.com. Which ones you
see can depend on your plan and your country;
what each of the seven actually costs you is set out once.
| Method | What it is | |
|---|---|---|
| Authenticator app (TOTP) | Supported | Computed on your own device; nothing is sent to produce it. |
| Hardware security key | Supported | A physical key you tap; the one option phishing does not beat. |
| The service’s own app | Supported | Software this service publishes; it works, and only here. |
| SMS text message | Supported | Texted to your number, so your carrier is part of the lock. |
| Voice call | Supported | Read out over a call; the same carrier dependency as SMS. |
Data sourced from 2FA Directory by 2factorauth. Snapshot 2026-09-24.
Google Account offers both SMS and an authenticator app. They are not equivalent — a texted code depends on your mobile carrier and survives no longer than control of your phone number, while a generated code never travels. If both are enabled, the account is only as strong as the weaker one, because an attacker picks.
A hardware security key is also accepted. It is stronger than any code, because a code can be typed into a convincing fake page and a key cannot. The usual arrangement is a key as the primary factor and an authenticator app as the backup that fits in a pocket.
Google Account also publishes its own apps for this — Google Prompts, Google Smart Lock. It works, and it works only here: an account secured that way needs that software on whatever device you are holding.
Of the fifty services on this site, nine publish software of their own as a second factor,
and Google Account is one of them. No other service here accepts exactly this combination of factors. Among the four services filed under backup,
three accept a hardware security key —
Google Account among them.
The directory files Google Account under backup, records five of the seven second
factors it tracks, and points at instructions published at
safety.google/authentication. That host is worth a second look: it is not drive.google.com, which is the
address the same record gives for Google Account itself. The page for not being able to complete sign-in is somewhere else again, on
support.google.com.
Google Account's own instructions: Google Account — two-factor authentication — linked, never copied, because a stale menu path here locks people out.
Google Account publishes a page for exactly this situation: what to do when you cannot complete two-factor sign-in. ⭐ Read it before you need it — the steps almost always require something you have to set up in advance.
Background: how the codes work · what still works when the phone is gone.
An iPhone, iPad and Mac authenticator for these codes that makes no network calls at all. What is free and what Pro adds. Get it on the App Store