Google Account passkeys shift trust to device unlocking

Google began rolling out passkeys on 3 May for personal Google Accounts. They’re an additional sign-in option, not an immediate end to passwords. Workspace administrators will get the ability to enable them soon.

Photo: Anthony Quintano, “Google at the 2012 Democratic National Convention North Carolina”. Taken 6 September 2012. CC BY 2.0. Resized and cropped. Historical Google display; no endorsement implied.

Chrome added passkey support in December. The browser feature needed individual websites to adopt it.

The company’s same-day security explanation puts the distinction in practical terms: a passkey sign-in skips both the password and the separate two-step verification prompt. The device’s fingerprint, face check or PIN unlocks the credential locally; biometrics aren’t sent to Google.

Anyone who can unlock a device holding the passkey can enter the account. Google warns against creating one on a shared device.

Using a phone’s passkey to approve a sign-in elsewhere doesn’t automatically copy it there. Lost-device passkeys can be revoked, and Google still recommends recovery phone and email details. Password fallback remains available.