Labs · Cyber Security
Lab: Set Up a Password Manager and Turn On 2-Step Verification for Your Gmail
Course: Cyber Security · Chapter 22: Password Attacks
Chapter 22 shows how passwords get attacked; this lab is the defence.
Chala mitrano! Today we stop using one password everywhere. We put every password into one locked vault, and we add a second lock to Gmail. It takes about 40 minutes, and after that a leaked password alone cannot open your Gmail. Ghabru naka, every click is written below.
चला मित्रांनो! आज आपण सगळीकडे एकच password वापरणं बंद करतोय. सगळे passwords एका locked vault मध्ये ठेवायचे, आणि Gmail ला दुसरं lock लावायचं. साधारण 40 मिनिटं लागतात, आणि त्यानंतर फक्त leak झालेल्या password ने तुमचं Gmail उघडत नाही. घाबरू नका, प्रत्येक click खाली लिहिला आहे.
चलो दोस्तों! आज हम हर जगह एक ही password इस्तेमाल करना बंद करेंगे। सारे passwords एक locked vault में रखेंगे, और Gmail पर दूसरा lock लगाएंगे। लगभग 40 मिनट लगते हैं, और उसके बाद सिर्फ leak हुए password से आपका Gmail नहीं खुलेगा। घबराओ मत, हर click नीचे लिखा है।
Suppose we are…
Suppose we have just joined Infosys as a fresher in Pune. Our offer letter, our salary-account alerts and the "forgot password" links of Instagram, LinkedIn and our UPI apps all come to one personal Gmail. And we use the same password on Gmail and on a small shopping site. One day that shopping site leaks its password list (a data breach, which means stolen customer data gets published or sold). Attackers then try that same email and password on Gmail. If Gmail opens, every account linked to it can be reset.
In this lab we break that chain in two ways. First, a password manager (an app that stores a different strong password for every site inside an encrypted vault) means no two sites share a password. Second, 2-Step Verification (Google's name for two-factor login: password plus a second proof from your phone) means a stolen password alone is not enough.
Goal of this lab
By the end you will have:
- A free Bitwarden vault, protected by a long master password and its own two-step login.
- 2-Step Verification turned on for your Gmail, with an authenticator app and printed backup codes.
- A new, unique Gmail password saved in the vault.
- A tested sign-in that asks for the second step.
What you need (all free)
- Your own Gmail account and its current password.
- Your own smartphone (Android or iPhone) with an authenticator app: Google Authenticator or Microsoft Authenticator from the Play Store or App Store.
- A laptop or desktop with Chrome, Edge or Firefox.
- A pen and paper, or a printer, for backup codes.
- Bitwarden (free plan) as the password manager. Google Password Manager or another reputable manager also works; the steps are similar.
Safety and ethics
Do this lab only on your own accounts and your own devices. Never set up or "test" 2-step login on someone else's account, even to help, without them sitting with you. Do not do it on a cyber café or office PC. If your Gmail is managed by your college or company, the IT team may control 2-Step Verification, so use a personal Gmail.
Part 1: Set up the password manager
- Open bitwarden.com in your browser and click the sign-up button (Get started or Sign up).
- Enter your email address and your name, keep the server region as bitwarden.com, and click Continue.
-
Open the email from Bitwarden and click Verify email.
What you should see: a page that asks you to set a master password.
-
Make a master password (the one password that unlocks the vault). Use a passphrase of 4 or 5 random words with a number, for example the pattern
word-word-word-word-47. Do not use the example itself, your name, your birthday or any old password. - Write the master password on paper and keep it at home. Bitwarden cannot reset it for you if you forget it.
-
Click Create account, then log in to the web vault with your email and master password.
What you should see: an empty vault page with Vaults in the left menu.
-
Open the Chrome Web Store (or Firefox Add-ons / Edge Add-ons), search Bitwarden Password Manager, check that the publisher is Bitwarden Inc., and click Add to Chrome.
- Click the puzzle-piece icon next to the address bar and click the pin next to Bitwarden, so its shield icon stays visible.
-
Click the Bitwarden icon and log in with your email and master password. If Bitwarden emails you a one-time code for this new device, enter it.
What you should see: the extension shows your (empty) vault.
-
Protect the vault itself. In the web vault go to Settings → Security → Two-step login.
- Next to Authenticator app, click Manage and type your master password.
- On your phone, open Google Authenticator (or Microsoft Authenticator), tap + and choose Scan a QR code. Scan the QR code on the screen.
-
Type the 6-digit code from the phone into the box and click Enable.
What you should see: Authenticator app shows as Enabled with a green tick.
-
On the same Two-step login page, click View recovery code, write the code on your paper next to the master password, and keep the paper safe.
Part 2: Turn on 2-Step Verification for Gmail
- Open myaccount.google.com (or in Gmail, click your profile picture → Manage your Google Account).
- In the left menu click Security & sign-in (older screens call it Security).
- Under How you sign in to Google, click 2-Step Verification, then Turn on 2-Step Verification. Google may ask for your password again.
-
Follow the on-screen steps. Add your mobile number if asked, and allow Google prompts on your phone if Google offers them.
What you should see: the 2-Step Verification page now says it is on.
-
On the same page, click Authenticator → Set up authenticator.
-
On your phone, in the authenticator app, tap + → Scan a QR code and scan Google's QR code. Click Next, type the 6-digit code and click Verify.
What you should see: your Google account appears in the authenticator app with a 6-digit code that changes every 30 seconds.
-
Back on the 2-Step Verification page, click Backup codes → Get backup codes. Click Print or Download.
- Print the 10 codes (each is 8 digits and works only once) and keep the paper with your master password. If you downloaded them, delete the file from the Downloads folder after printing.
Part 3: Give Gmail a new unique password and test
- In the Bitwarden extension, click + (New item) → Login. Name it
Google - Gmail, fill your Gmail address as the username, and click the Generate icon in the password box. - Set the length to at least 16, then click Use this password and Save. The new password is now in the vault before you change anything at Google.
-
In your Google Account, go to Security & sign-in → Password. Copy the new password from Bitwarden (copy icon) and paste it twice. Click Change password.
What you should see: Google confirms the change. Other devices may ask you to sign in again.
-
Test it. Open a private window (Ctrl + Shift + N in Chrome, Cmd + Shift + N on Mac), go to gmail.com and sign in with the new password copied from the Bitwarden app or web vault.
What you should see: after the password, Google asks for the second step (a prompt on your phone or a 6-digit code). The inbox opens only after you approve it.
-
Close the private window. Finally open myaccount.google.com/security-checkup and fix anything it marks in yellow or red.
Ravindra Bagale's Tip
Many students save the backup codes as a screenshot in the phone gallery, or email them to the same Gmail. If the phone is lost, both the second step and the codes are gone together. Print them, and keep the paper at home with the master password. Dhyan rakho!
Ravindra Bagale's Tip – मराठी
बरेच students backup codes चा screenshot phone gallery मध्ये ठेवतात, किंवा त्याच Gmail वर email करतात. Phone हरवला तर second step आणि codes दोन्ही एकदम जातात. Codes print करा, आणि तो कागद master password सोबत घरी ठेवा. ध्यान रखो!
Ravindra Bagale's Tip – हिंदी
बहुत से students backup codes का screenshot phone gallery में रखते हैं, या उसी Gmail पर email कर देते हैं। Phone खो गया तो second step और codes दोनों एक साथ चले जाते हैं। Codes print करो, और वो कागज़ master password के साथ घर पर रखो। ध्यान रखो!
Common mistakes
| Mistake | What happens | Fix |
|---|---|---|
| Changing the Gmail password first and saving it later | You forget the new password and get locked out | Generate and save in Bitwarden first (steps 23–24), then change it at Google |
| A short or reused master password | One leak or a good guess opens the whole vault | Use a 4–5 word passphrase that you use nowhere else |
| Installing a fake "Bitwarden" extension | A copycat extension can steal what you type | Check the publisher is Bitwarden Inc. and the link comes from bitwarden.com |
| Only SMS as the second step | SIM-swap fraud (someone gets a duplicate SIM of your number) can steal SMS codes | Add the authenticator app and Google prompts; keep SMS only as a backup |
| Sharing a 6-digit code on a phone call | Scammers use the code to log in as you | Google never calls you for a code. Never read a code out to anyone |
| Backup codes in the gallery or in the same Gmail | Lost phone = lost codes | Print them and keep them at home |
Self-check checklist
0 of 6 done
Try-at-home challenge
Pick the three accounts that matter most after Gmail, for example Instagram, LinkedIn and the email linked to your bank. For each one:
- Save a new generated password in Bitwarden.
- Change the password on the site.
- Turn on two-factor login (on Instagram: Accounts Center → Password and security → Two-factor authentication).
Then, with their permission and on their own phone, help one family member turn on 2-Step Verification for their Gmail. Teaching someone else is the best test that you really understood it.
Samjla ka? One vault, one strong master password, and a second lock on Gmail. Aata pudhe jaauya: the next lab checks what your own laptop shows to the network.