Passkeys are a simple and secure alternative to passwords. With a passkey, you can sign in to your Google Account with your fingerprint, face scan, or phone screen lock, like a PIN.
- If your account has 2-Step Verification or is enrolled in the Advanced Protection Program, a passkey bypasses your second authentication step, since this verifies that you have possession of your device.
- Your biometric data, used for fingerprint or face unlock, stays on your device and is never shared with Google.
Why should I use a passkey?
Passkeys provide the strongest protection against threats like phishing. Once you create a passkey, you can use it to easily sign in to your Google Account, as well as some third-party apps or services, and to verify it's you when you make sensitive changes.
Why are passkeys safer than passwords?
Unlike passwords, passkeys can only exist on your devices. They can't be written down or accidentally given to a bad actor. When you use a passkey to sign in to your Google Account, it proves to Google that you have access to your device and are able to unlock it.
What do I need to create a passkey?
To create a passkey, you need one of these:
- A laptop or desktop that runs at least Windows 10, macOS Ventura, or ChromeOS 109.
- A phone that runs at least iOS 16 or Android 9.
- A hardware security key that supports the FIDO2 protocol.
Tip: To create a passkey on a FIDO2 hardware security key added to your Google Account prior to May 2023, you may first need to remove this security key from your account. After it’s removed, you’ll be able to create a passkey on this security key.
Your computer or mobile device also needs a supported browser like:
- Chrome 109 or up
- Safari 16 or up
- Edge 109 or up
- Firefox 122 or up
To create and use a passkey, you must enable the following:
- Screen lock
- Bluetooth
- This applies if you want to use a passkey on a phone to sign in to another computer.
- For iOS or macOS: You must turn on iCloud Keychain.
- When you set up a passkey on your Apple device, it prompts you to turn on your iCloud Keychain if not set up already. For more info on how to set up iCloud Keychain, go here.
Tip: To ensure the best passkeys experience, make sure your operating system and browser are up to date.
Based on your operating system and browser, you may not be able to create or use passkeys while in Incognito mode.
Passkeys for Google WorkspaceIf you have a Google Workspace account through your school or employer, you may not be able to sign in to your account with just a passkey. You can still create passkeys on your devices, but they may only be used as a second factor in 2-Step Verification, in account recovery, and for some sensitive actions in your account that require Google to re-verify your identity.
In the "Skip password when possible" account settings page, you can find whether your admin allows you to sign in with just a passkey.
Workspace admins can learn more here.
How do I set up passkeys?
Important: When you create a passkey, you opt in to a passkey-first, password-less sign-in experience. Create passkeys only on personal devices that you control. Even if you sign out of your Google Account, once you create a passkey on a device, anyone who can unlock the device can sign back into your Google Account with the passkey.
To set up a passkey, you may need to sign in to your Google Account or verify it’s really you.
Create a passkey- Go to https://myaccount.google.com/signinoptions/passkeys.
- Tap Create a passkey
Continue.
- You'll be required to unlock your device.
To create passkeys on multiple devices, repeat these steps from those devices.
To create a passkey on an external FIDO2 capable USB security key:
- Go to https://myaccount.google.com/signinoptions/passkeys.
- Tap Create a passkey
- Follow on-screen instructions.
- You'll be required to insert your hardware security key and enter its PIN or touch the fingerprint sensor on the key.
Tips:
- Once you create your first passkey, the next time you sign in on any device that supports passkeys, you'll be prompted to create a passkey on that device.
- If you don't want other users to access your account, do not create a passkey on a shared device.
How do I use my passkey to sign in?
- On your device, open the Google sign-in page.
- Enter your username.
- Note: When you tap on the username field, you may see a list of passkeys. If so, tap the passkey you’d like to use.
- If you have previously created a passkey for your account on that device, Google will prompt you to verify your identity with that device's passkey.
- To unlock the device and verify your identity, follow the on-screen passkey instructions provided by your operating system and browser.
Tips:
- When you sign out of an Android device:
- You can use your passkey to sign back in on this Android device for up to 6 hours post-sign out. After 6 hours, you need to use an alternate method to sign back in. When you sign back in, Android automatically generates a new passkey and the old passkey expires.
- When you sign out of a non-Android device:
- You can sign back in with your passkey at any time after sign out.
- On the Google sign-in page on your computer, enter your username.
- Below the password field, click the Try another way link.
- Click Use your passkey.
- On your screen, find the QR code.
- If you want to use a passkey that was created on a hardware security key, you'll have an option to select "USB security key" or equivalent.
- To scan the QR code, use your phone's built-in QR code scanner app.
- For iOS: You can use the built-in camera app.
- For Google Pixel phones: You can use the built-in QR code scanner.
- For other Android devices: If you can't scan the QR code with the native camera app or the system QR code scanner, you can use Google Lens.
- On your phone, tap Use passkey.
- To verify your identity on your phone, you'll be prompted for your fingerprint, face unlock, or phone PIN.
- The next time you sign in with this computer and phone combination, you'll automatically get a notification on your phone to complete the identity verification process.
Tip: After you sign in, you may be asked to create a passkey on the computer. If you don't want other users to access your account, do not create a passkey on a shared device.
How do I sign in with a password & a passkey?
By default, when you create a passkey you opt in to a passkey-first, password-less sign-in experience. If you would like to always use your password first, you can change this default preference in your account settings.
- Go to your Google Account.
- You may need to sign in.
- Select Security.
- Under "How you sign in to Google," turn off Skip password when possible.
When this option is turned off and you sign in, you'll be prompted for your password. If you're enrolled in 2-Step Verification, you'll have the option to use any of your passkeys as the second step.
How do I check my passkeys?
- Go to https://myaccount.google.com/signinoptions/passkeys.
- You may be asked to verify your identity.
- Tip: If you're signed into multiple accounts, make sure you are verifying your identity for your desired account.
If your account already has passkeys, they’re listed here.
- Tip: If you have an Android phone signed in with this account, you may have passkeys registered automatically for you.
How do I remove or delete passkeys?
If you lose a device where you created a passkey, or created a passkey on a shared device by mistake, you should invalidate the passkey for use with your Google Account.
Remove a passkey that you created
- Go to your Google Account.
- You may need to sign in.
- Select Security.
- Under "How you sign in to Google," tap Passkeys and security keys.
- Select the passkey you want to remove.
- Tap the
icon.
Remove a passkey automatically created by Android
To remove a passkey that was automatically created on your Android phone, you need to remove the device from your Google Account.
-
Go to your Google Account.
-
On the left navigation panel, select Security.
-
On the Your devices panel, select Manage all devices.
-
Select the device
Sign out.
-
If multiple sessions appear with the same device name, they could all come from the same device or multiple devices. If you want to make sure there’s no account access from a device, sign out of all the sessions with this device name.
Tips:
- You can check google.com/devices to review all devices with access to your account.
- If you removed a passkey from your Google Account, but you’re still prompted to use it at sign-in, check any third-party credential manager that you use to see if the passkey is there. If so, remove the passkey from the credential manager.
- For instructions on how to remove the passkey, go to your credential manager’s support documentation.
What if my passkey is lost or missing?
Lost or stolen device- On a device you’re able to access, sign in to your Google Account.
- Remove the passkey associated with the lost or stolen device.
If you have passkeys on your account but aren't offered a passkey during sign-in, make sure that:
- The device with the passkey has the screen lock enabled.
- If your device's screen lock is disabled, you will not be able to use the passkey on that device until you enable the screen lock again.
- The "Skip password when possible" toggle is on in your security settings at myaccount.google.com/security.
To sign in to your Google Account without a passkey, tap Try another way to skip the passkey challenge and go back to your earlier sign-in choices.
Tip: If you choose "Try another way" often, Google will offer the passkey challenge less frequently in the future to reflect your implied preferences. You can change this by repeatedly signing in with passkeys.
