What is Google Passkey: A New Way to Say Goodbye to Traditional Passwords

Let me start with a painful fact: most people have problems with how they manage their passwords.

Either all accounts use the same password (convenient, but if one is stolen, all are lost), or the password is too complicated for you to remember (and then you keep clicking "forgot password"), or there is a two-step verification but you have to take out your phone and enter the verification code every time you log in (so troublesome that you want to smash your phone).

Google's Passkey, which it has been heavily promoting since 2023, aims to solve these problems all at once. No need to remember passwords or enter verification codes; just scan your fingerprint or face to log in.

Sounds like a sci-fi movie? Actually, it's not that far-fetched. Read on.

What exactly is a Passkey?

In the simplest way to understand it: Passkey is simply using your fingerprint, facial recognition, or screen lock instead of a password .

What do you use to unlock your phone? Fingerprint or Face ID, right? Passkey works on the same logic—except it's not used to unlock your phone, but to log in to your Google account (and increasingly more other websites).

Specifically, after you set up a Passkey for your Google account, the next time you log in:

Open the Google login page and enter your email address.
The system pops up a prompt asking you to verify your identity.
You press the fingerprint sensor / glance at the camera / enter your phone's screen lock password.
Done, went straight in.

There was no password input field, no SMS verification code, and no "Please open the Google Authenticator app." The whole process took two or three seconds.

The underlying principles (you can skip this if you don't want to read the technical details)

Passkey is based on a technical standard called FIDO2/WebAuthn . This is not a proprietary technology developed by Google, but an open standard established by the FIDO Alliance, with participation from giants like Apple, Microsoft, and Google.

The simplified principle is as follows:

When you create a Passkey, your device (phone or computer) generates a key pair:

The private key — resides locally on your device and is never sent anywhere.
Public key — sent to Google servers for storage

When you log in, Google's servers send a "challenge" to your device. Your device signs it with its private key and sends it back. Google then verifies the signature using its public key. If the verification is successful, you are allowed to log in.

The key point is that your private key never leaves your device . Google's servers only have the public key. Even if Google were hacked (although the probability is extremely low), the hacker would have no use for the public key because it cannot be used to log in.

This is completely different from traditional passwords. Traditional passwords are based on the premise that "you know a secret, and the server also knows that secret," meaning a hacker can log in as long as they obtain the secret from either end. Passkeys, on the other hand, are based on the premise that "only your device knows the secret, not the server," thus eliminating the possibility of password leakage at its root.

What are the advantages over traditional cryptography?

Unafraid of fishing attacks

The biggest security vulnerability of traditional passwords is not brute-force attacks, but phishing. Scammers create a fake Google login page; once you enter your password, it ends up in their hands.

Passkey doesn't work that way. Your device verifies the website's real domain name during authentication. If the fake website's domain name doesn't match the real accounts.google.com , the device will reject the verification. You don't even need to distinguish between real and fake sites yourself—the device does it for you.

Not afraid of password leaks

Because there's no password at all. The server doesn't store any credentials that could be used for direct login. Database leak? Doesn't matter; the public key is public, so it's useless to them.

Not afraid of credential stuffing attacks

The so-called "credential stuffing" technique involves hackers obtaining leaked usernames and passwords from one website and trying them on other websites. Since many people use the same passwords, this tactic often works. However, a Passkey is linked to a specific website, and each website has a unique key pair, so there's no such thing as "credential stuffing" with a Passkey.

The login experience is so much better.

No need to remember passwords, no need to enter verification codes, no need to wait for SMS messages. Just press your fingerprint and you're done. To be honest, once you get used to it, going back to entering passwords feels incredibly primitive.

How to set up a Passkey for your Google account

The setup process is very simple and can be done in five minutes.

Set up on your phone

Open myaccount.google.com in your browser.
Log in to your Google account
Enter the "Security" page
Find "Passkeys and security keys" .
Click "Create Key"
Follow the prompts to verify your fingerprint or facial recognition.
Finish

If you're already logged into your Google account on your Android phone, the system may have automatically created a Passkey for you; you can check it in your settings.

Setting up on your computer

Open the Chrome browser and visit myaccount.google.com
Similarly, go to "Security" → "Keys and Security Keys"
Click to create
If your computer supports fingerprint recognition (such as Touch ID on a MacBook), you can verify your identity directly with your fingerprint.
If your computer doesn't have biometric authentication, you can choose to create one by scanning a QR code with your mobile phone.

Can be set on multiple devices

A Google account can be linked to multiple Passkeys. It's recommended that you set one up on your frequently used devices: one on your phone, one on your computer, and one on your tablet. This way, you can log in quickly no matter which device you use.

Frequently Asked Questions

What should I do if I lose my phone?

This is everyone's biggest concern. The answer is: Don't panic .

First, even if someone finds your phone, they can't use your Passkey because they still need your fingerprint or facial recognition to access it. Second, your original Google account password and two-step verification haven't been deleted; the Passkey is an additional login method, not a replacement. Even if your phone is lost, you can still log in with your password; just go to settings and delete the Passkey for the lost device.

Additionally, if you're using an iPhone, the Passkey will sync to your other Apple devices via iCloud Keychain. Android devices sync via Google Password Manager. So even if one device is lost, the Passkey on the other devices will still be there.

Can the Passkey be used across devices?

Yes, you can. If you created a Passkey on your phone, you can select "Use another device" when logging in on your computer, then scan the QR code on the computer screen with your phone, and verify your identity on your phone. It's not particularly convenient, but perfectly acceptable for occasional use.

If I set up a Passkey, can I still use my original password?

Yes. Currently, Passkey and password coexist. Setting a Passkey will not delete your password, and you can always revert to password login. Google's current policy is to prompt you to use Passkey, but it's not mandatory.

Which devices support this?

iPhone — iOS 16 and above
Android — Android 9 and above (Android 14+ recommended for a better experience)
Mac — macOS Ventura and above
Windows — Windows 10 and above (via Windows Hello)
Browsers — Chrome 109+, Safari 16+, Edge 109+

If your device is older, it may not be supported. However, devices purchased after 2023 should generally be compatible.

Besides Google, which other websites support Passkey?

The list is growing. Currently supported companies include: Apple, Microsoft, GitHub, PayPal, Amazon, eBay, WhatsApp, TikTok, Uber, Shopify, Adobe, Nintendo… and it's still expanding. You can view the complete list of supported companies passkeys.directory .

Will Passkey completely replace password?

It won't happen in the short term, but it's highly likely in the long term.

At present, Passkey still has several practical problems:

Lack of user awareness —many people simply don't know this thing exists.
Device dependency —It requires a supported device to use, making it inconvenient to use on public computers.
The ecosystem is still developing —cross-platform synchronization (such as from iPhone to Windows) isn't smooth enough yet.
Incomplete website support – many small and medium-sized websites have not yet been integrated.

But the trend is clear. In 2024, Google announced that Passkey usage had surpassed traditional two-step verification. Apple and Microsoft are also pushing it heavily within their respective ecosystems. The FIDO Alliance is working to solve the problem of cross-platform synchronization.

In three to five years, you might no longer be asked to set a password when registering a new account; you can simply create a Passkey.

Recommendation: Start using it now.

You don't need to wait for Passkeys to become fully widespread before you start using them. You can add one to your Google account now and experience the feeling of passwordless login.

Operation suggestions:

First, create a Passkey on your most frequently used device and get a feel for the login process.
Do not delete your original password and two-step verification ; use the Passkey as an additional quick login method.
Configure it on 2-3 frequently used devices to avoid single point of failure.
Check if your other frequently used accounts (Apple ID, GitHub, Amazon, etc.) also support Passkey; if so, set them up as well.

Passwords have been around for decades; it's time for a change. Passkeys aren't futuristic technology; they're already in use. Since they're both more secure and convenient, there's no reason not to give them a try.