Google has issued a strong recommendation for its 2 billion Gmail and Google Account users: it’s time to stop using traditional passwords. Citing a significant increase in online attacks and widespread risky password habits, Google’s security experts are urging users to switch to a much more secure login method called passkeys. This shift is crucial because passwords are a major weak point hackers exploit, while passkeys offer robust protection that’s also easier to use.
Contents
Key Takeaways:
- Email accounts, including Gmail, are frequent targets for cyberattacks.
- Many people still use weak or reused passwords, putting them at high risk.
- Google strongly recommends replacing your password with a passkey for enhanced security.
- Passkeys are more secure, phishing-resistant, and use your device’s built-in security.
- Switching to a passkey is simpler than you might think.
Why Passwords Aren’t Safe Anymore
You might think your password is good enough, especially if you haven’t been hacked yet. But the reality is, the digital threat landscape is constantly evolving, and passwords are becoming increasingly vulnerable. Google points out that a large percentage of users have been targeted by email attacks, and a significant number have experienced a data breach.
A recent survey confirms just how risky our password habits are. Nearly half of adults in the U.S. admit to practices that make them easy targets. The biggest culprits? Reusing the same password across different accounts (a quarter of those surveyed do this) and using personal information like pet names, family names, birthdays, or addresses. Hackers can often find this kind of information through social media. Even worse, some people are still using passwords they know have been compromised in past breaches!
Gmail logo displayed on a smartphone screen, representing email security and Google's recommendation for passkeys.
While using a random password generator or a password manager is a safer bet than creating them yourself, Google believes the best solution is to move beyond passwords entirely. Passwords can be guessed, stolen, or tricked out of you through phishing attacks. You need a login method that doesn’t have these weaknesses.
Meet Passkeys: Google’s Recommended Upgrade
Google’s answer to the password problem is the passkey. Think of a passkey as a unique, super-secure digital key tied to your device (like your phone or computer) and your Google Account. Instead of typing a password, you use your device’s built-in security, like your fingerprint or face scan, or simply unlocking your screen.
This might sound simple, and that’s part of the genius. It feels easier than typing a complex password, but technically, it’s far more secure.
How Passkeys Protect You Better
Passkeys work differently than passwords. When you sign in with a passkey, your device and the website (like Google) perform a secure handshake using cryptographic keys. One key stays on your device (private), and one is with Google (public). They work together to verify it’s you without ever sending a secret password over the internet where it could be intercepted.
The key advantages are:
- Phishing Resistant: Hackers can’t trick you into revealing your passkey because you’re not typing anything. You’re just using your device’s secure unlock method.
- Strong by Default: You can’t create a “weak” passkey. They are all cryptographically strong from the start.
- Can’t Be Stolen Like Passwords: There’s no password string to be leaked in a data breach or stolen by malware. The private key never leaves your device in a way that’s useful to an attacker.
This makes signing in both safer and often faster than dealing with passwords and even traditional two-factor authentication (2FA) steps, as the passkey itself confirms you have your trusted device.
What Happens If You Lose Your Device?
A common worry about passkeys is putting all your security eggs in one basket – what if you lose the phone or computer you use for your passkey? Experts say this is actually less risky than losing access due to a stolen password.
Passkeys linked to your Google Account are typically synced across your devices using secure cloud services (like iCloud Keychain on Apple or Google Password Manager on Android/Chrome). This means your passkey isn’t stuck on just one device. If you lose one device, you can still access your account and passkeys from another trusted device linked to your account. You can also often de-authorize lost or compromised devices through your Google Account settings.
Compared to a stolen password, which a hacker can use from anywhere, a passkey requires physical possession of your unlocked device, plus your biometric or screen lock, making it much harder for a thief to use.
Ready to Switch? Here’s How to Set Up Your Google Passkey
Switching from your Gmail password to a passkey for your Google Account is straightforward. Google recommends having the following ready:
- A computer running Windows 10+, macOS Ventura+, or ChromeOS 109+.
- A smartphone with iOS 16+ or Android 9+, with Bluetooth and screen lock enabled.
- A recent version of a compatible browser (Chrome, Edge, Firefox, Safari).
- iCloud Keychain enabled if you’re using Apple devices.
Once you have these, follow these simple steps:
- Go to your Google Account Security settings. Look for the “How you sign in to Google” section and select the Passkeys option.
- Click on Create a passkey and follow the on-screen prompts.
- You’ll be asked to verify your identity, likely using the fingerprint or face recognition on your computer or smartphone, or by entering your device’s screen lock PIN.
That’s it! You’ve now created a passkey. The next time you sign in to your Google Account (including Gmail), you’ll likely be prompted to use your passkey instead of typing your password. You’ve just significantly upgraded your online security against common attacks.
Moving beyond passwords is one of the most impactful steps you can take to protect your digital life. Google’s push for passkeys makes it easier than ever to make that crucial change for your most important online account.
Interested in learning more about staying safe online? Explore related articles on securing your other accounts and devices.
