Introduction
Before you read
This article is not affiliated with or endorsed by Google LLC. It primarily is written for personal Google Accounts and not Google Workspace accounts for work or school. It primarily seeks to improve the knowledge about passkeys in general and for passkeys in Google Accounts in particular.
Google’s account passkey and password processes may change at any time, or without prior notice, so check the relevant Help Center articles or other publicly available Google documents for the current steps.
This article explains what passkeys are, how to set one up safely, and where they fall short. Part 1 covers the basics and whether a passkey suits you. Parts 2 and 3 cover preparation and setup. Parts 4 and 5 cover what to do if you lose access or are about to give up a device. Parts 6 to 8 cover management, limits, and common questions.
Part 1: What Passkeys Are and Whether You Need One
1.1 What a Passkey Is
A passkey is a pair of cryptographic keys, and it is not a piece of hardware. Each passkey is tied to the site or app it was created for. One half of the pair is shared with the site, and the other half stays private, stored either on your device or in your password manager. For a Google Account, that means your passkey never works on a fraudulent site, and there is no password to type or steal.
1.2 Types of Passkeys and How They Are Created
A passkey for your Google Account can come from four places.
1.2.1 Passkeys Created in a Browser, on Mobile or Desktop
Creating a passkey works only in a browser. On the device where you want the passkey, open your browser and go to myaccount.google.com/signinoptions/passkeys. Tap or click Create a passkey, then follow the prompts.
1.2.2 Passkeys Created Automatically on Mobile Devices
On some phones, a passkey can appear without you creating it. On an Android device signed in to your account, a passkey may be registered for you automatically. To avoid sign-in problems, make sure these are in place:
- Android: Android 9 or newer, with a screen lock turned on (fingerprint, face unlock, or PIN). You also need to be signed in to your Google Account on the phone.
- iPhone and iPad: iOS 16 or newer, with iCloud Keychain turned on. After you create your first passkey, a later sign-in may prompt you to create one for that device.
1.2.3 Passkeys Created on a Physical Security Key
Tap or click Create a passkey, then Use another device, and follow the prompts. The key must support FIDO2, and you will enter its PIN or touch its fingerprint sensor.
1.2.4 Passkeys Created in a Third-Party Password Manager
Password managers such as 1Password, Dashlane, LastPass, and Bitwarden can store passkeys. If a passkey you removed from your Google Account still prompts you at sign-in, check your password manager and remove it there.
Helpful information: passkeys for other sites
This is separate from your Google Account passkey. When you sign in to an app or site with a password saved in Google Password Manager, it may create a passkey for you, and it shows a notification when it does. You can turn this off in Google Password Manager. You do not need to change anything on the website or app itself.
1.3 Whether You Need One
If you sign in to your Google Account on a phone or computer you control, a passkey can make daily sign-in quicker and reduce how often you type a password. It is also more secure than the passwords most people use. A passkey cannot be guessed or reused, and it only works on the site or app it was created for, so it cannot be handed to a fake site the way a typed password can.
It is less useful if you share devices, or if you cannot keep a second device or backup method ready. Read Part 4 before you decide.
Part 2: Before You Set One Up
2.1 Use Only Devices You Control
Create passkeys only on personal devices that you control. Even after you sign out of your Google Account, anyone who can unlock a device with a passkey can sign back in with it. Do not create one on a shared or borrowed device.
2.2 Know What Changes
Creating a passkey opts you in to a passkey-first, password-less sign-in. Your password stays on the account. Until you are comfortable with how passkeys work, you can leave “Skip password when possible” off in your security settings and keep using your password as before.
2.3 Check Your Passkeys After You Sign In
After you have signed in to your account on an Android device, go to your Google Account, select Security, and under “How you sign in to Google,” choose Passkeys. The page lists the devices that hold a passkey for your account. A passkey may already be there from the sign-in, even if you did not set one up. Checking this list is a quick way to see the sign-in options you have created or enabled for this account across different devices.
2.4 Plan Your Way Back In
Before you create a passkey, check whether 2-Step Verification or Advanced Protection is already on for your account, and check your recovery phone number and recovery email address. If 2-Step Verification is on, backup codes can serve as a second step. If Advanced Protection is on, only a backup security key works as the second step, so make sure you have one before you create a passkey. Part 4 explains how each option works.
Part 3: Setting Up and Signing In
3.1 Creating a Passkey
Go to myaccount.google.com/signinoptions/passkeys. Select Create a passkey, then Continue. You will be asked to unlock your device to finish. Do this only on a device you control.
3.2 Signing In with a Passkey
Enter your username on the Google sign-in page. If passkeys appear in a list, select the one you want to use. If you would rather use your password, select Try another way.
3.3 Signing In on a Computer with Your Phone
On the computer’s sign-in page, enter your username, select Try another way, then Use your passkey. A QR code appears on the computer. Scan it with your phone’s camera or a QR scanner app, then tap Use passkey. Verify with your fingerprint, face, or PIN. Keep Bluetooth turned on for this to work.
Part 4: If You Lose Access
4.1 Passkeys with Advanced Protection and No 2-Step Verification
With Advanced Protection on, signing in requires a passkey or security key, and your password alone will not get you in. If you lose the device with your passkey and have no other passkey, security key, or signed-in device to sign in with, you will need to recover the account. Recovery takes extra steps to verify your identity and can be delayed for a few hours or a number of days. A recovery phone number and recovery email address on the account help with this. A backup passkey or security key stored somewhere safe lets you sign in without going through recovery.
If you lose a device with a passkey, consider taking the steps in Part 6.
Important information
Recovery delays are set by Google, and the references in Part 9 explain how they work. Do not rely on a fast recovery. Keep a backup passkey or security key in a safe place before you need it.
4.2 Passkeys with 2-Step Verification On
With 2-Step Verification on, you can sign in with your password and a second step, such as a Google prompt on a device you are already signed in on, a verification code, a backup code, or a security key. If you lose the device with your passkey, you can still sign in as long as you can complete one of these steps. If you cannot, you will need to recover the account, and recovery can be delayed. Turning on 2-Step Verification can make a recovery delay longer.
Part 5: Before You Reset, Sell, or Trade In a Phone
Before you reset, sell, or trade in a phone that has one of your passkeys, remove that passkey from your Google Account to prevent sign-in issues. The steps are in Part 6.
If that phone is the only device with a passkey for your account, it is the only thing standing between you and access to your account. Before you let go of it, make sure you can still sign in on another device or with a backup method.
Pro tip
A second signed-in device can be a lifeline if your passkey device is lost, stolen, or damaged. If you do not have one, treat your passkey device as your main key and look after it closely. Backup options for that situation are covered in Part 4.
Part 6: Managing and Removing Passkeys
To see the devices that hold your passkeys, go to myaccount.google.com/signinoptions/passkeys, or open your Google Account, select Security, and under “How you sign in to Google,” choose Passkeys. Select the device you want to remove, then choose the remove option. You may be asked to verify your identity first.
If you still see a device you no longer use, or one you do not recognize, remove its passkey. If you still want to use passkeys on your other devices, you can keep the “Skip password when possible” setting on. If you would rather always start with your password, turn it off. Decide which of these fits how you sign in.
If you often choose “Try another way” when signing in, the passkey option will be offered less often. To change that, sign in with a passkey several times. For more on this, see Google’s Help Center article on signing in with a passkey.
Pro tip
Removing a passkey you created affects only that passkey on that device. For a passkey created automatically on Android, sign the device out of your account instead. If a passkey prompt still appears after you remove one, check your password manager and your Google Account settings.
Part 7: Caveats and Limits
7.1 Shared and Borrowed Devices
Do not create a passkey on a shared or borrowed device. Anyone who can unlock that device may be able to use the passkey to sign in to your account. If you have already done this by mistake, remove the passkey from your account as soon as you can.
7.2 Browser and System Requirements
Passkeys need a current operating system and browser. Google’s Help Center lists Chrome 109 or later, Safari 16 or later, Edge 109 or later, and Firefox 122 or later. A device without a screen lock cannot use its passkey until the lock is turned on.
7.3 The Wait for a New Passkey
A newly created passkey may take up to seven days before it works at sign-in. A trusted passkey or physical security key can sometimes speed up this process.
7.4 Incognito and Private Browsing
Some browsers and systems do not let you create or use a passkey in a private window. If a passkey option does not appear, try a normal window.
Part 8: Common Questions
8.1 Can I See the Passkey Itself?
No. A passkey’s private part stays on the device or in the password manager where it was created, and the account holds only the public part. You cannot write it down or copy it out.
8.2 Does Adding a Passkey Remove My Other Sign-In Options?
No. Adding a passkey does not change or remove your existing recovery or sign-in options.
8.3 Can I Use a Passkey on a Computer?
Yes, if your phone has the passkey. You can sign in on a computer by using the passkey on your phone, provided Bluetooth is on and the two devices are close together.
8.4 Do I Need to Understand How Passkeys Work?
No. You need to know where your passkeys are stored, which second steps are on your account, and how to recover your account if you lose a device.
8.5 Why Does Google Keep Offering to Create a Passkey?
Once you create your first passkey, your next sign-in on a device that supports passkeys may ask you to create one for that device too. You can decline, and you can turn these prompts off by changing the “Skip password when possible” setting.
8.6 Why Was a Passkey Created on My Android Phone When I Did Not Set One Up?
Android phones can create passkeys during the sign-in process, on the phone itself. If you have another device signed in to your account, use it to remove the passkey. Go to Your devices, select Manage all devices, choose the phone, and sign it out.
Important information
If this phone is your only device, signing it out means removing your Google Account from the phone. Your email, contacts, calendar, and settings are removed from the phone, but they stay with Google, and you can get to them again by signing in to the account on any other device or in a browser. For up to six hours after signing out, you can still use the passkey on this phone. After that, the passkey cannot be used to get into your account on this phone, and you will need another sign-in option.
Part 9: References and Sources
- Get Google’s strongest account security with the Advanced Protection Program. https://support.google.com/accounts/answer/7519408?hl=en (Used in: 4.1)
- Why your account recovery request is delayed. https://support.google.com/accounts/answer/9412469 (Used in: 4.1, 4.2)
- Common questions with Advanced Protection Program. https://support.google.com/accounts/answer/7539956 (Used in: 2.4, 4.1)
- Fix common issues with 2-Step Verification. https://support.google.com/accounts/answer/185834 (Used in: 2.4, 3.2, 4.2)
- Sign in with a passkey instead of a password. https://support.google.com/accounts/answer/13548313 (Used in: 1.2.2, 1.2.3, 2.3, 3.1, 3.2, 3.3, 6, 7.2, 7.3, 7.4, 8.6)
- Sign in if you lost your security key. https://support.google.com/accounts/answer/9153624 (Used in: 4.1, 4.2)
- NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management. https://csrc.nist.gov/pubs/sp/800/63/b/4/final (Used in: 1.3)
- Syncable authenticators, NIST SP 800-63B-4. https://pages.nist.gov/800-63-4/sp800-63b/syncable (Used in: 1.3)
- FIDO Alliance Design Guidelines. https://fidoalliance.org/design-guidelines/ (Used in: 6)
- Use passwords and passkeys across your devices. https://support.google.com/pixelphone/answer/6197437 (Used in: 1.2 helpful information box)
Conclusion
A passkey is one of the strongest sign-in tools available for a personal Google Account, because it cannot be guessed, reused, or handed to a fake site. Its value depends on preparation: using only devices you control, keeping a second sign-in method ready, and knowing how to remove a passkey when a device is lost, sold, or reset.
No comments:
Post a Comment
Please do not post spam or promote your own site(s). All comments are moderated and such comments will not be published.
Also, please keep your comment relevant to the topic of the article.
Finally, please do not post any of your personally identifiable information such as phone number, email address or other important details as this is an open platform.