Lock down your Google and Apple accounts: passkeys, recovery and sessions

For most people, one account sits above all the others: the Google or Apple account on their phone. It holds your email, so it can reset other passwords. It often holds your saved passwords and photos too. Twenty minutes spent on it is worth more than hours spent anywhere else. Here’s what to check, in order.

Google

1. Add a passkey. A passkey lets you sign in with your phone’s fingerprint, face or screen lock instead of a password. Google notes that passkeys can’t be shared, copied, written down or accidentally given to someone else, which makes them more resistant to phishing. Go to myaccount.google.com/signinoptions/passkeys and create one on each phone or computer you personally own. A few things worth knowing, all from Google:

• Adding a passkey doesn’t remove your password or your other sign-in and recovery options.
• If 2-Step Verification is on, a passkey counts as both steps.
• Only create one on devices you own. Anyone who can unlock that device can get into your account.
• A new passkey can take up to 7 days to be offered at sign-in.

2. Check your recovery options. Run Google’s Security Checkup at myaccount.google.com/security-checkup. Make sure the recovery phone and email are ones you still control. An old work address or a number you gave up is a way in for someone else.

3. Review your devices. Visit google.com/devices. Sign out of anything you don’t recognize or no longer use. Google points out that several sessions with the same device name might be different devices, so sign out of all of them if you’re unsure.

If you face targeted risk (journalists, activists, people leaving an abusive relationship, anyone who handles large sums), Google’s Advanced Protection Program is its strictest setting.

Apple

1. Turn on Stolen Device Protection on your iPhone: Settings, Face ID & Passcode, Stolen Device Protection. Apple says it’s designed for the case where someone steals your phone and knows your passcode. Away from familiar places like home or work, it requires Face ID or Touch ID, with no passcode fallback, to use saved passwords and passkeys or to erase the phone. Changing your Apple Account password or recovery settings also needs a one-hour wait and a second Face ID or Touch ID check. It needs iOS 17.3 or later and has to be on before the phone goes missing.

2. Decide how you’d recover. In Settings, tap your name, then Sign-in & Security. Check that your trusted phone numbers are current. You can add a Recovery Contact, someone you trust who can help you get back in. You can also set up a recovery key, a 28-character code that replaces Apple’s standard recovery process. A recovery key gives you more control, but Apple is blunt about the trade-off: if you lose it and your devices, you can be locked out permanently. Store it on paper, somewhere safe, and not in Notes, Photos or iCloud Drive.

3. Consider security keys if you face targeted risk. With Security Keys for Apple Account, signing in on a new device needs a physical key or one of your trusted Apple devices. Apple says this helps stop your second sign-in step from being intercepted or requested by an attacker. You need at least two FIDO Certified keys, and losing all of them and your devices can lock you out.

4. Review your devices. In Settings, tap your name and scroll to the device list. Remove any you don’t recognize or no longer own.

Both

• Use a unique password for the account, even with a passkey. Your password still exists as a fallback.
• Keep your phone’s screen lock strong. Passkeys are only as private as the lock on the device that holds them.
• Never read a sign-in code to someone who contacted you, whoever they say they are. Hang up, and go to the account yourself.

Sources

• Google Account Help, Sign in with a passkey instead of a password
• Google, Advanced Protection Program
• Apple Support, About Stolen Device Protection for iPhone, July 31, 2026
• Apple Support, Set up a recovery key for your Apple Account, September 14, 2026
• Apple Support, About Security Keys for Apple Account, April 28, 2026