Google Urges Gmail Users: Ditch Your Password for a Passkey Now

Your Gmail account is more than just email; it’s often the key to your digital life. But with online threats constantly evolving, traditional passwords just aren’t cutting it anymore. That’s why Google is making a strong recommendation: it’s time to replace your Gmail password with a passkey for better security and easier access.

Here’s the quick scoop: Email accounts, including Gmail, are facing increasing attacks, and many people still use risky passwords. Google says switching to a passkey is a simple yet powerful way to protect yourself, offering a login method that’s resistant to common hacks like phishing and is actually easier to use.

Why Your Gmail Password Isn’t as Safe as You Think

You might think your password is secure, but the reality is hackers are constantly trying to break in. Google itself admits that email attacks have targeted a large number of people – a staggering 61% of U.S. consumers, according to their data.

The problem is, most of us still rely on passwords, and our habits aren’t great. Recent research highlights just how risky our password choices are:

• Nearly half (49%) of U.S. adults engage in risky password practices.
• A quarter (24%) admit to reusing the same password across multiple online accounts. This is like using the same key for your house, your car, and your office – if a hacker gets one, they get them all.
• Even worse, 8% are using passwords they know were compromised in a previous data breach!
• Many use easily guessable information like pet names (14%), family names (11%), parts of their own name (11%), or important dates (15%). Hackers can often find this information through social media.

Using simple or reused passwords leaves your account vulnerable to automated attacks or phishing scams where criminals try to trick you into giving away your login details. Learn how some people are using secret Gmail addresses to add another layer of protection against these kinds of attacks.

Google’s vice-president of privacy, safety, and security, Evan Kotsovinos, states clearly that Google wants to move “beyond passwords altogether.” The recommended alternative? Passkeys.

Gmail logo on a smartphone screen, representing Google's push for stronger email security and the adoption of passkeys instead of traditional passwords.

What Exactly is a Passkey?

Think of a passkey as a modern, upgrade to your password, designed for the current digital world. Instead of typing a secret word or phrase, a passkey lets you log in to websites and apps using the security features built into your device, like your fingerprint, face scan, or device PIN.

Here’s the simplified tech behind it: When you create a passkey for your Google account, your device and Google work together to create a unique pair of cryptographic keys – a ‘public’ key that Google keeps, and a ‘private’ key that stays only on your device. When you log in, your device uses the private key to prove its identity to Google’s public key, all without sending any secret information over the internet that could be intercepted.

Why is this better than a password?

• Phishing Resistant: You can’t be tricked into giving your passkey away because you never type it or show it to anyone. The login happens securely between your device and the website.
• Strong by Default: Passkeys are cryptographically generated, making them virtually impossible for hackers to guess or crack using brute-force attacks. You can’t accidentally create a “weak” passkey.
• Can’t Be Stolen in Breaches: Unlike passwords stored on company servers (sometimes in a way that makes them vulnerable if the company is hacked), the private part of your passkey never leaves your device.

Passkeys essentially replace the need for remembering complex passwords and offer a more secure, often faster, login experience. When you use a passkey, it often bypasses the need for a separate two-factor authentication code because possessing and unlocking your device is the strong second factor.

Addressing Concerns: What If You Lose Your Device?

A common question about passkeys is: If they are tied to your device, what happens if you lose your phone or computer? This is a natural concern, but passkeys are designed with this in mind, making them more resilient than passwords in many loss scenarios.

Here’s why:

• Synced Across Devices: When you create a passkey, it’s typically synced across your other devices signed into the same account (like your Google Account or Apple ID, if you have iCloud Keychain enabled). If you lose one device, you can often access your passkeys and accounts from another.
• Device Security: Even if a stolen device has your passkey, the thief can’t use it without unlocking the device first, which usually requires your fingerprint, face scan, or PIN – things they don’t have.
• Remote Management: You can manage your passkeys and devices through your account settings. If a device is lost or stolen, you can often de-authorize that specific device’s passkey remotely, cutting off access.

Security experts point out that this synced and device-secured approach is far safer than relying on passwords, which can be stolen from databases or tricked out of you via phishing, regardless of whether you still have your device.

How to Make the Switch to a Passkey for Gmail

Ready to upgrade your Gmail security? Switching from your password to a passkey with Google is straightforward. First, make sure you have what you need:

• A computer running Windows 10+, macOS Ventura+, or ChromeOS 109+
• A smartphone on iOS 16+ or Android 9+, with Bluetooth and screen lock enabled
• A compatible browser (like Chrome, Edge, Firefox, or Safari)
• For Apple users, iCloud Keychain needs to be enabled for syncing across devices.

Once you’re set, here are the simple steps:

1. Go to your Google Account settings.
2. Navigate to the “Security” section and find the “How you sign in to Google” options. Select “Passkeys.”
3. Click on “Create a passkey” and follow the on-screen prompts.
4. You’ll be asked to verify your identity, likely using your device’s screen lock method (fingerprint, face scan, or PIN).

And that’s it! You’ve successfully created a passkey for your Google account, which includes Gmail. The next time you log in, you’ll likely be prompted to use your passkey instead of typing your password. You’ve just significantly boosted your protection against many common online threats.

Using a passkey is a simple step that provides a major leap in security and convenience for your Gmail account. It’s Google’s recommended path forward to help you avoid becoming another victim of email hacking. To learn even more details directly from Google, you can visit their official passkeys page. Explore other critical security updates impacting Google services, like recent alerts for Google Messages users.