Skip to content
Skip to main content
header search
CompileHub
Menu
sticky search

Google "strongly encourages" its users to stop using passwords

Most users who have online accounts sign in using passwords. While there are some outliers, using security keys, passkeys and other advanced sign in options, the majority still relies heavily on passwords.

That is a problem, at least according to Google. The advertising company published a new article on its main site, The Keyword, that highlights the advantages of going beyond passwords.

Google backs this up with data. According to Google, 50 percent of consumers use passwords across accounts, which increases the risk of successful attacks against the user. Furthermore, another 50 percent writes down passwords or memorizes them.

Google gives a high-five to Gen Z users in the article, which bypass "outdated security norms like passwords" by opting in "for more advanced authentication tools.

The generation is 31 percent more likely to use passkeys and 32 percent more likely to use social sign-ins daily. Google notes furthermore that 60 percent of Gen Z spend at least five hours on their phones every day.

Clearly, more times on phones and less time on computers is fueling the shift. Social sign-ins, for example, allow users to sign in to services using accounts that they already use. Prime examples are Google or Meta accounts, which unlock access to a variety of services.

At least part of the shift comes from a shift in usage towards mobile devices. Convenience and speed is key here for many users.

Passkeys and Social Sign Ins are the answer, according to Google

Google recommends the switch to passkeys and social sign-ins. Clearly, the company benefits from social sign-ins, as it is one of the largest provider of such a service on the Internet.

When users create accounts at supported services, they may use their existing Google, Meta, Microsoft and Co. account for that. They do not have to set up a new password, provide their email address, or other information that is tied to the existing account.

Social sign ins are convenient, like using a single key for multiple doors, but also risky, if they get lost or stolen.

For users, social sign ins raise privacy concerns as large advertising companies like Meta or Google get to know even more about their activities on the Internet.

Passkeys are security keys that are stored partially on the user's devices. This removes traditional password attacks, such as phishing, as users no longer enter a password when they sign in online.

The average cost of a phishing breach is 4.8 million Dollar according to IBM. AI-driven phishing is on the rise, getting more sophisticated and scalable.

In simple terms: A passkey is generated on the user's device. A secret part remains on the device, or is synced to other user devices, while online services only receive a part that they use to verify the authenticity.

When users with passkeys sign in, they are asked to verify the process using biometrics or their device PIN. A password is never entered or transferred.

Google fails to mention that passkeys are not widely supported yet. While awareness and usage increases year-on-year, as reported in May 2025 by the FIDO Alliance, passkeys still have a long way to go to replace passwords.

Getting passkeys from one device to another is also not as comfortable as it could be. While Google Password Manager supports synchronization already, many do not at all or only with limited capacities.

The situation will improve in the future. For now, passkeys work in selected environments only.

Security keys are not mentioned specifically by Google. These hardware USB-keys improve portability, but they come with additional costs and often storage limitations. Google's own Titan Security key supports passkeys in its latest iteration, but storage is limited to 250 passkeys. That may sound like a lot for users who use a handful of online services. For some, it would mean having to juggle around with different hardware keys.

Google does highlight how password-users can ramp up their security. The unsurprising answer is through the use of 2-step verification. Ideally, by using an authenticator application and not insecure methods, like SMS or email.

SMS and email are insecure, as codes are send in clear-text. Means, it is relatively easy to intercept the codes.

Password managers like the open source Bitwarden improve password security significantly. They create strong unique passwords with a click, store them safely in the user's vault, and support syncing to make the passwords available on all of the user's devices.

Closing Words

Google’s push for passkeys and social sign-ins offers home users a promising escape from risky passwords, with 50% of users reusing them, fueling identity theft losses and other consequences. While Gen Z leads with 31% passkey adoption, limited app support and privacy concerns with social sign-ins highlight trade-offs. Home users should embrace free 2FA apps like Authy or explore passkeys on services like PayPal, but broader adoption and simpler syncing are needed to truly replace passwords.

More exciting content