How to Recover Your Gmail Account After Being Hacked

From your home screen, open Settings and tap Google, then tap your name and choose Manage your Google Account. That's the page that tells you whether you're still signed in on this phone.

If your Google Account page opens and shows your name, email and account options — like this — then you're in luck: you're still signed in on this phone. You can change your password straight from here, so carry on to the next step.

Still signed in? Reset your password to lock the attacker out:

1. Tap your account, then Google Account
2. Open Google password (under Security & sign-in)
3. Enter a strong, unique new password and tap Change password

Google won't always drop you straight onto the password screen — it may ask you to verify it's you first. If you're lucky, your phone still has a passkey or sign-in prompt set up, which makes that quick and easy and gets you right to the reset.

Unlike full recovery, changing your password from a signed-in device doesn't always sign everyone else out — so do it yourself:

1. In your Google Account, open Security (or Security & sign-in info)
2. Go to Your devices → Manage all devices
3. Tap anything you don't recognise and choose Sign out

While you're there, glance over your recent security activity for anything unfamiliar. The follow-up guide below walks through the full cleanup.

Open the Gmail app and tap your profile picture in the top-right corner, then choose Manage your Google Account. What loads next tells you whether the app is still signed in.

If the Google Account page opens with your name, email and the usual options, your app session is still good — you're signed in. That means you can reset your password without touching full recovery, so move on to the next step.

Still in? Reset the password to shut the attacker out:

1. Tap your profile picture → Manage your Google Account
2. Open Google password (under Security & sign-in)
3. Pick a strong, unique new password and tap Change password

Don't be surprised if Google asks you to confirm it's you first — a passkey or sign-in prompt on this phone clears that in seconds.

A password reset from the app won't always end the attacker's other sessions, so close them off yourself:

1. Open Security (or Security & sign-in info) in your Google Account
2. Tap Your devices → Manage all devices
3. Pick out anything unfamiliar and hit Sign out

Give your recent security activity a quick scan while you're in there.

Before you go near the recovery page, pick up a device you've already signed into this account on — your usual phone or laptop, ideally on your home Wi-Fi. Google trusts familiar devices, browsers and networks far more, and that can be the single biggest factor in getting back in.

1. Go to g.co/recover (or accounts.google.com/signin/recovery)
2. Enter your Gmail address and continue
3. Work through whatever prompts Google offers — they depend on what's still attached to the account

Google will offer one or more ways to prove it's you. Try them in this order — the first is by far the strongest:

• Google prompt on a signed-in device — if a phone (or the Gmail app) is still signed in, Google sends a tap Yes prompt. Fastest and most reliable.
• Passkey or security key — if you set one up, use it now
• Recovery phone — enter the code texted to your number
• Recovery email — check that inbox (and spam) for a code
• Last password + account details — even an old password, plus answers like roughly when you created the account, help confirm you

However you got verified — a prompt on a signed-in device, a passkey, a recovery code, or by answering Google's security questions in the recovery form — you'll then be asked to set a new password. Make it long (16+ characters), unique to this account, and store it in a password manager.

That gets you back in — but don't assume the attacker's other sessions are gone. The steps below show how to sign them out and check what was changed while they had access.

Now that the account is yours again, force out anyone else who's still in:

1. In your Google Account, open Security (or Security & sign-in info)
2. Go to Your devices → Manage all devices
3. Tap anything you don't recognise and choose Sign out

This is the step that actually ends the attacker's lingering sessions — a password reset alone won't always do it.