What does Google's Security Checkup actually show about your Gmail access?

Three steps the checkup runs through

The announcement lists three actions: review signed-in devices, remove old third-party app access, and confirm recovery information. Each step targets a different way someone or something could read your mail.

The first step shows every device where your account is currently active. The second step reveals apps you authorized at some point in the past. The third step checks the backup contact details Google uses when you cannot sign in. Together they cover the three main paths into an inbox: active sessions, delegated access, and account recovery.

What the device list tells you

Signed-in devices include phones, laptops, and tablets where you stayed logged in. The checkup shows the device type and the last time it was active. You can revoke access with one tap. Revoking access signs the account out on that device immediately. The next time someone opens Gmail on that device they will be asked for your password. This matters if you sold a phone, lost a tablet, or simply forgot to sign out on a shared computer.

The list does not show the physical location of the device. It does not show the IP address. It only shows the device name and the timestamp of the last activity.

Third-party apps

You may have authorized services to read or send email years ago and forgotten about them. The list lets you cut off the ones you no longer use. Each entry shows the app name and the date you approved it. It also shows what level of access the app has. Some apps can only read your email. Others can send mail on your behalf. A few have full access to delete or organize messages.

Removing an app revokes its token. The app will stop working with your Gmail until you grant permission again. The announcement does not say whether removing an app deletes data the app already stored on its own servers.

Recovery details

Recovery information means the backup email and phone number Google uses if you lose your password. Keeping those current prevents lockout. If you change your phone number and forget to update it here, you may not receive the verification code Google sends when you try to recover the account.

The checkup displays the current recovery email and phone number. It does not test whether they actually work. It only shows what is on file. You must update them manually if they have changed.

Where the help center fits in

Google also points to a Gmail Help Center guide covering phishing and unwanted senders. The Security Checkup does not scan for phishing. It only shows access points. The help center fills that gap with separate instructions.

The guide explains how to report suspicious messages, how to block senders, and how to use Gmail's built-in spam filters. Those features operate independently of the Security Checkup.

What the announcement does not cover

The post does not say how many accounts have run the checkup. It does not say how many devices or apps the average user finds. It does not explain what happens if you revoke access on a device you still own. You will need to sign in again on that device. The announcement also does not mention whether the checkup runs automatically on a schedule. It only invites you to run it manually. There is no data on how long the process takes for accounts with many devices or many authorized apps. The title says two minutes but that is an estimate.