Skip to content
respawnr
Menu

Steam · Independent guide

How to Secure Your Steam Account: A Practical Checklist

Concept illustration of device, email and authenticator security around a gaming account.

Steam lists the ways accounts actually get taken: a compromised email, malware on a trusted PC, phishing and fake support staff. Each protection below answers one of those, and you set all of them yourself in Steam's own settings. Work through them in order and you close the common doors.

Start the checklist

We never ask for your password, Steam Guard codes, recovery code or API key. You change settings only on Steam.

Concept illustration, not a screenshot of the recovery process.

On this page

Steam's own tools

Every step uses the Steam client, the Steam Mobile app or official Steam pages.

No secrets collected

We never ask for passwords, codes, API keys or card numbers.

Independent guide

Respawnr is not affiliated with Valve; menus change, so follow what your client shows.

Five protections, and the attack each one stops

Set them up in this order; each closes a door Steam itself names.

1. Secure the email first, then a unique Steam password

Steam lists a compromised email among the ways accounts get stolen, because a Steam password can be reset through it.

  • Give the email on your Steam account its own strong password and two-factor sign-in.
  • Use a Steam password you use nowhere else, never the same as your email's.
  • Steam emails you about security changes, so keep watching that inbox.

2. Turn on the Steam Mobile Authenticator

Steam calls phone codes its best level of account security, because each sign-in needs a device you hold.

  • In the Steam Mobile app, open the Steam Guard tab and choose Add authenticator.
  • Codes change every 30 seconds and work only once, even without internet.
  • You can approve sign-ins by QR scan, app prompt or the shown code.

3. Keep the recovery code and backup codes offline

The recovery code shown during setup lets you remove the authenticator if the phone is gone; keep it off the phone.

  • Write the recovery code on paper; Steam says not to skip this step.
  • Print backup codes rather than saving them; Steam says no screenshots.
  • Add a phone number you control in Account Details under Contact Info.

4. Review authorized devices and sign out old ones

Malware on a PC that is already authorized is on Steam's list of how accounts are stolen.

  • Check Authorized Devices on the Steam store account page for anything you don't know.
  • Use Sign out everywhere if a device looks wrong; each needs a code again.
  • Scan your PC for malware and install games and tools from official sources only.

5. No Web API key you don't use, and read every trade confirmation

Steam says an API key should never be shared, and a redirected trade can only be spotted if you check the confirmation screen yourself.

  • If a key exists that you didn't create, or you ever shared one, revoke it at steamcommunity.com/dev/apikey.
  • Before confirming a trade in the app, check the partner and every item.
  • In any Steam sign-in page or 'Sign in through Steam' pop-up, type your login only if the address is store., help. or www.steampowered.com, or steamcommunity.com.

Settings that quietly weaken a secure account

Habits Steam warns about that undo the protections above without any alert.

Saved login, shared PC
On shared or public PCs, don't save credentials and fully exit Steam when done.
Shared phone number
Steam may treat accounts on one number as one identity, bans included.
Move, don't remove
Moving the authenticator to a new phone beats removing it, which brings a long trade restriction.
Codes on screen
Backup codes in a screenshot or file sit wherever malware can read them.

Steam says removing the authenticator means 15 days without trading or the Community Market, and moving it means 2 days, at the time of writing (September 2026). Nobody from Steam will contact you in Steam Chat or Discord, and an unexpected change to your own profile threatening a ban means your account security is compromised.

What these protections do, and where they stop

Protection prevents losses; it does not undo ones that already happened.

With the Mobile Authenticator on, a stolen password alone is not enough to sign in from a new device.

The limit: Malware on a PC you already authorized, or you approving a fake prompt, can still get through.

Steam says items stop being held up to 15 days once the authenticator has been on for 7 days.

The limit: Trades made before or during those first 7 days are still held; Steam's timings at the time of writing (September 2026) may change.

A recovery code on paper lets you remove the authenticator yourself if the phone is lost.

The limit: Without the code or the account's phone number, you need a Steam Support ticket and may need proof of ownership.

Respawnr will never ask for your password, Steam Guard codes, recovery code or API key.

The limit: We explain official steps only; we cannot sign in to, change or recover any account.

Steam says Support does not restore items that left an account for any reason, cannot lift trade or Market restrictions, and cannot remove VAC bans, so the time to secure the account is before anything happens.

A few details worth knowing

What is the single most important thing to do to secure a Steam account?

Secure the email linked to Steam, then turn on the Steam Mobile Authenticator. Steam lists a compromised email among the ways accounts are stolen, and phone codes as its strongest sign-in protection.

Is email Steam Guard enough, or do I need the mobile app?

Email Steam Guard is better than nothing, but if the email is compromised it protects little. Steam says the authenticator also removes long trade holds once it has been on for 7 days.

Do I need to redo this checklist when I get a new phone or PC?

Partly: use Move Authenticator rather than removing it (Steam says a 2-day restriction instead of 15 days), review Authorized Devices, and store the new recovery code on paper; see the recovery-code guide.

Do I need a Steam Web API key?

Most players don't. If you have one you didn't create or you shared it, revoke it on the official Steam API key page and check every trade confirmation carefully.

Does the Mobile Authenticator protect me from phishing pages?

Not fully: if you type your login on a fake page or approve a prompt you didn't start, the attacker can still get in, so check the address before signing in; see the phishing guide.

Go a little deeper

Official guidance

Check the platform’s current instructions and the options shown for your own account.