Sign-in codes and trusted devices
When we ask for a 6-digit code, how long a device stays trusted and what ends it.
A password alone isn't enough to sign in on a new phone or browser. We also send a 6-digit sign-in code. Once a device has used a code, it is trusted for a while, so you don't need a code every time.
Works in:Android appWeb app
When we ask for a code
- On a phone or browser that hasn't signed in to your account before.
- Again on a trusted device after 30 days.
- After your password was changed or reset.
- After Sign out everywhere.
- In a private or incognito browser window, or after you clear your browser's data, because the browser forgets that it is trusted.
Where the code goes
- By text message (SMS) to your phone, if your phone number is verified.
- Otherwise by email.
The screen shows where it went, with part of the number or address hidden, for example "u***@gmail.com".
Screenshot coming soon
Rules for codes
- A code works for 10 minutes, and only once.
- You can ask for a new code after a short wait (the timer shows when). Use the newest code.
- After 5 wrong codes, start the sign-in again with your password.
- We send a limited number of codes per hour, so someone with your password can't flood your phone with texts. If you hit the limit, wait an hour.
How long a device stays trusted
A device stays trusted for 30 days after you enter a code on it, unless one of these happens first:
- you change or reset your password;
- you use Sign out everywhere;
- you clear the browser's data or reinstall the app.
Signing out of one device on its own doesn't stop it being trusted.
Older versions of the app
Sign-in codes need a recent version of the Android app. If your app is too old to show the code screen, signing in tells you to update first. See Required updates.