Passkeys

A passkey uses the security built into your phone, computer, or security key (for example Touch ID, Face ID, Windows Hello, or an Android screen lock). It can sign you in without typing the account password.

Passkeys are optional. Password sign-in, password reset, and any existing two-factor authentication continue to work.

Getting a passkey

A passkey is offered after sign-in. After you sign in with your password on a computer or phone that supports Touch ID, Face ID, Windows Hello or a screen lock, the portal asks once in a platform-specific prompt that names your device’s method: Touch ID on a Mac, Face ID or Touch ID on iPhone and iPad, Windows Hello on Windows, or your fingerprint or screen lock on Android. Other devices see a neutral Sign in with a passkey next time? Choose Create passkey and approve the device prompt; from then on this device signs in with the passkey. Choose Not now and the portal will not ask again on this device for 30 days.

If this device already has your passkey, the portal says so, remembers it and stops asking on this device.

On some browsers the portal can save the passkey silently after a password sign-in, with no extra prompt.

You can also add one at any time from Settings → Account → Passkeys.

How to add a passkey

Go to Settings → Account → Passkeys, choose Add passkey, and give it a name that identifies the person and device, such as “Ivan’s MacBook”. Enter the current password, or sign in with Google again if the account has no password, then complete the browser or device prompt.

The Add button appears only in browsers that support passkeys. In another browser, you can still rename or remove passkeys that are already registered.

Signing in

The Sign in with a passkey button appears on devices where a passkey was created or used before; passkey autofill can still suggest the sign-in on other devices. A verified passkey sign-in counts as two-factor authentication.

Shared accounts

If several people use one portal account, each person should add a passkey from Settings → Account → Passkeys and name it after their own device, such as “Ivan’s MacBook”. Each person can see, rename, and remove only their own passkeys; an account owner cannot manage a team member’s passkeys.

Adding a passkey generally asks for a recent password or OAuth reauthentication; a recent password sign-in also qualifies for the initial offer. Signing in with Google does not show the offer (Google sign-in is already passwordless); you can still add a passkey under Settings → Account → Passkeys. Removing a passkey asks for reauthentication. This prevents someone with an unattended browser session from adding their own device.

Changing or removing a passkey

Renaming and removing a passkey also require a recent password or OAuth reauthentication. After removing one, also remove it from the device’s password manager if you no longer want it there. Removing it from the portal does not automatically remove that device-only orphan.

Lost or replaced device

Use another registered passkey, sign in with the account password, or use password reset to recover access. Do not remove the last working recovery method until a new device is confirmed.