Passkeys are now the default option for signing in to personal Google accounts – Google

Usernames are generic and usually easy to remember, while passwords are private and often recommended to consist of a combination of upper and lower case letters, numbers, and special characters. However, the common practice of reusing passwords compromises their security. Passkeys provide an innovative solution to the problem of managing multiple unique passwords, and Google’s latest move is leading the way in promoting their widespread use.

Google Announce Passkeys will now be the default sign-in option for all personal Google accounts. When users sign back into their accounts, they will be prompted by Google to create and use a passkey. Additionally, Google Accounts settings will default to “Skip passkeys when possible,” although users can choose not to use passkeys. In any case, the company does not force users to use the new login method, and gives them the option to restore the old method.

Google points out that passkeys are already used in its other services, such as YouTube, Search, and Maps. Other companies like Uber and eBay have also implemented passkeys. Additionally, Google’s blog notes that WhatsApp is in the process of developing passkey compatibility.

Passkeys use biometrics such as fingerprint/facial recognition or hardware pin to unlock a mobile device or password manager as the first step in user authentication. The service provider stores a public key, while the authentication device keeps the private key locally. These keys are mathematically related but not identical. The service (for example, a web page) sends a query to the authenticator, which is resolved using the private key. The service then verifies the response using the public key, without needing to access the private key.

Passkeys are generally considered more secure than traditional passwords, which are often simple and reusable across multiple platforms. Passwords are also stored in remote databases, making them vulnerable to hacking. In contrast, passkeys are unique and do not need to be remembered by users, while private keys are not stored on the server.

Google’s initiative to make passkeys a standard for personal Google accounts represents a major advance in adoption. This move will likely encourage more apps and developers to follow suit.