For decades, passwords have been the weakest link in cybersecurity. They are easily forgotten, frequently reused across multiple websites, and highly susceptible to phishing attacks. To solve this, Google, Apple, and Microsoft formed an alliance to create Passkeys—a revolutionary technology designed to replace the password entirely.
Instead of typing a string of characters to log into your Google Account, a Passkey allows you to authenticate using the exact same method you use to unlock your phone or computer: your face, your fingerprint, or a local device PIN. The cryptographic key is stored securely on your local device and never transmitted over the internet, making it practically impossible for hackers to steal via phishing.
Requirements for Using a Google Passkey
Because Passkeys rely on the physical security hardware of your device, you need modern equipment to use them:
- A Smartphone: An iPhone running iOS 16 or later, or an Android device running Android 9 or later.
- A Computer: A PC running Windows 10/11 (with Windows Hello configured), or a Mac running macOS Ventura or later (with Touch ID).
- A Supported Browser: Google Chrome, Apple Safari, or Microsoft Edge.
- Screen Lock Enabled: Your device must have a screen lock (PIN, fingerprint, or facial recognition) actively enabled. You cannot create a Passkey on an unprotected device.
How to Create a Passkey for Your Google Account
Setting up a Passkey takes less than a minute. It is highly recommended to create the Passkey on the device you use most frequently, such as your primary smartphone or your personal laptop.
- Open your web browser (e.g., Chrome) and navigate to myaccount.google.com.
- Log into your Google account using your traditional password one last time.
- In the left-hand navigation menu, click on Security.
- Scroll down to the “How you sign in to Google” section and click on Passkeys.
- You will be prompted to verify your identity by entering your password again.
- On the Passkeys dashboard, click the blue Create a passkey button.
- A system dialog box will pop up. This box is generated by your operating system (Windows, macOS, iOS, or Android), not the web browser. It will ask you to confirm your identity using your device’s biometric sensor.
- If on a Mac: Place your finger on the Touch ID sensor.
- If on a PC: Look at the webcam for Windows Hello, or enter your Windows PIN.
- If on a phone: Use Face ID or your fingerprint scanner.
- Once the biometric scan succeeds, Google will confirm the Passkey has been created.
How to Log In Using Your New Passkey
The next time you log out and need to sign back into Gmail or Google Drive on that device, the experience will be drastically faster and safer.
- Go to the Google login page and type your email address. Click Next.
- Instead of a box asking for your password, the screen will prompt you to “Use your passkey to confirm it’s really you.”
- Click Continue.
- Your device will instantly prompt you for your fingerprint, face, or PIN.
- The moment you authenticate, you are logged in. There is no password to type and no SMS code to wait for.
What Happens If You Lose Your Device?
Because Passkeys are physically tied to the device (or the device’s secure cloud ecosystem, like Apple iCloud Keychain or Google Password Manager), losing your phone can seem terrifying. However, Google has built-in safeguards.
- You are not locked out: Creating a Passkey does not delete your old password. If your laptop is stolen, you can simply borrow a friend’s computer, type your email, select “Try another way” on the login screen, and type your traditional password to get in.
- Passkeys are useless to thieves: Because the Passkey requires your biometric data (your fingerprint or face) to activate, a thief who steals your phone cannot use the Passkey to log into your Google Account, even if they have the physical device in their hand.
If you lose a device, you should immediately log into your Google Account from a secure computer, go to the Security > Passkeys menu, and click the ‘X’ next to the lost device’s Passkey to permanently revoke its access.