Google welcomes passkeys. As of now, you can log into your Google account without a password, although Google admits that it will take some time for the password to disappear completely.

Google rolls master key out of. Passkeys are a technology for authenticating users without requiring a password. Instead, authentication occurs solely via an alternative such as a fingerprint. Logging in with a passkey is therefore more secure, although the login standard still has limitations.

Which key?

Passkeys build on a development that is already underway today. If you use strong passwords via a password manager, you usually no longer enter your password yourself when you log into an account. The password manager takes care of this, provided you have previously authenticated yourself to the manager.

Passkeys go one step further. When logging in, you will no longer be asked for a password, only to confirm your authentication. Today this is not done via a password manager, but via your operating system. The login page asks the operating system for confirmation of your identity, which you can provide, for example, with a fingerprint or Windows Hello.

Not perfect

Google now supports this type of login. You can go to your Google account settings to activate it. Unfortunately, there are still some disadvantages when implementing passkeys at this point. The main reason is the lack of synchronization. A master key is associated with an operating system and often even a device. Passykeys on your Android phone are not automatically synced to your Windows computer: you have to create them manually each time. For example, there’s a lot more setup work involved with passkeys if you want to use them on different devices compared to the relative simplicity of a password manager.

Now when you activate passkeys on Google, the passkey will first be activated on your Android smartphone that already has a Google account. If you then want to log in to your Google account on a Windows computer using a passkey, a QR code will appear that you have to scan with your smartphone. Your phone will then attempt to connect to perform passkey authentication. However, during our testing, the Android phone refused to connect to the Windows computer.

This is exactly why passkeys are an option for Google and nothing more. At this point, your password also remains linked to your Google account. If you unexpectedly need to log in somewhere, you can still do so with your password. During the test above, we were able to simply log in with a password and 2FA. Google hopes that passwords will disappear over time. In the meantime, it remains important to use a strong and long password.

Important step

Google’s introduction of Passkeys is an important step towards a password-free future. However, Google is not alone. The company works with Apple and Microsoft, among others, in the FIDO alliance to bring standardized alternatives to passwords to the masses. Since 2021, Microsoft not only allows you to log in with a passkey, but actually removes your password from your account. The latter is a big but important step: only when the password is completely gone can a cybercriminal no longer misuse it to log into your account.

Google will initially provide passkeys for personal accounts. Google Workspace account admins will also soon be able to grant end users access to passkeys, but Google isn’t specifying when.