In May 2024, Google used World Password Day to highlight the rapid adoption of passkeys and announce an expansion of Cross-Account Protection, while also previewing passkey support for its Advanced Protection Program. The announcements reflected a broader industry effort to reduce reliance on passwords and other authentication methods that can be stolen or phished.
Some of those plans have since moved from announcement to deployment. Passkeys are now available to users enrolling in Google's Advanced Protection Program, Android supports greater choice among credential providers, and Google Password Manager has expanded passkey synchronization beyond Android. The wider passkey ecosystem has also continued to grow.
Google's 2024 Passkey Milestone
Google said in its May 2024 security update that passkeys had been used to authenticate users more than 1 billion times across more than 400 million Google Accounts.
The timeline is worth clarifying. Google, Apple, Microsoft, and other members of the FIDO ecosystem announced plans in 2022 to expand support for common passwordless sign-in standards. Google then made passkeys available for Google Accounts in May 2023.
A passkey replaces a memorized secret with a cryptographic credential. When a passkey is created, the service retains a public key while the corresponding private credential remains with the user's device or credential provider. Signing in normally requires unlocking that credential with the same method used to unlock the device, such as a fingerprint, facial recognition, or screen-lock PIN.
Google says biometric information used to unlock a passkey remains on the user's device and is not sent to Google.
Why Passkeys Are More Resistant to Phishing
Traditional passwords can be copied, reused, leaked in data breaches, or entered into convincing fake websites. One-time codes sent by SMS or generated by authenticator apps add an important layer of protection, but users can still sometimes be tricked into providing those codes to an attacker.
Passkeys are designed differently. They are associated with the legitimate website or application for which they were created, and authentication depends on cryptographic verification rather than transmitting a reusable password. That makes a correctly implemented passkey resistant to conventional credential-phishing attacks.
At the time of its 2024 announcement, Google said passkey authentication was about 50% faster than using passwords in its measurements and that passkeys were being used for Google Account authentication more often each day than SMS and authenticator-app one-time passwords combined. Those figures were Google's own measurements rather than independent industry-wide benchmarks.
Adding a passkey also does not automatically erase every existing sign-in or recovery method on a Google Account. According to Google's current passkey documentation, creating one does not remove authentication or recovery factors that are already configured.
Cross-Account Protection Addresses a Different Security Problem
Passkeys were only part of Google's May 2024 announcement. The company also expanded Cross-Account Protection, a system intended to help participating services react when an important security event occurs on a user's Google Account.
The underlying problem is that online accounts are often connected. A compromised email account, for example, can potentially be used to reset passwords or interfere with accounts on other services.
Google's Cross-Account Protection documentation explains that participating services can receive cryptographically signed security-event notifications. The notifications are intentionally limited in scope, identifying the relevant security event and affected user so the receiving service can take an appropriate action.
Depending on the event, that could include ending active sessions, disabling Sign in with Google temporarily, removing a revoked token, or applying additional checks to the associated account.
When Google announced the expansion in May 2024, it said Cross-Account Protection covered 2.4 billion accounts across 3.4 million apps and sites. By October 2024, Google said the system was actively protecting 3.2 billion users across sites and apps where they signed in with a Google Account.
Passkeys Reached Google's Advanced Protection Program
Google also announced in May 2024 that passkeys would be added to the Advanced Protection Program, its enhanced security configuration for people at elevated risk of targeted attacks. Google lists journalists, activists, political campaign staff, business leaders, and IT administrators among the groups that may benefit from the program.
That feature was still described as upcoming in the original announcement. It became available on July 10, 2024.
Advanced Protection had traditionally relied heavily on physical security keys. Google now allows eligible users to enroll using a passkey instead of requiring the traditional physical-key setup. Physical FIDO security keys remain supported for people who prefer them.
Advanced Protection also goes beyond authentication. Google says the program applies additional restrictions to third-party access to account data, performs stronger checks around potentially harmful downloads, and adds extra safeguards to account recovery.
Android Gives Users More Choice Over Passkey Storage
Another important part of the transition is deciding where passkeys are stored. Passkeys are not limited to one company's password manager.
On Android, Google's Credential Manager provides a unified interface for credentials including passwords, passkeys, and federated sign-in methods. Android documentation confirms that Android 14 and later support third-party password and passkey providers through Credential Manager.
This allows compatible credential managers to participate in Android's sign-in experience instead of forcing every passkey to be stored in Google Password Manager. Providers still have to implement the required Android APIs, and users must enable the credential provider they want to use.
Google has also expanded its own manager. In September 2024, the company announced that users could save passkeys to Google Password Manager from Windows, macOS, Linux, and Android, rather than relying on an Android device to create and store them.
Passkeys Are No Longer a Small Experiment
The passkey ecosystem has expanded substantially since Google's original 2024 milestone. Passkeys are now supported across major operating systems and browsers, including Android, Windows, macOS, iOS, Chrome, Edge, and Safari, although individual websites and applications must still implement passkey authentication themselves.
In May 2026, the FIDO Alliance estimated that roughly 5 billion passkeys were in use worldwide. Its 2026 consumer research, conducted among 11,000 adults in ten countries, found that 75% of respondents had enabled a passkey on at least one account and 49% said they used passkeys regularly when they were available.
Those figures describe the broader passkey ecosystem rather than Google Accounts specifically, but they show how far the technology has moved beyond its early rollout.
Passwords Have Not Disappeared Yet
Despite the progress, the transition is not complete. Many services still depend on passwords, some devices and applications have limited passkey support, and account-recovery systems remain an important part of overall security.
Passkeys also do not make every other security precaution unnecessary. Users still need to protect the devices and credential-manager accounts that hold or synchronize their passkeys, maintain safe recovery options, install security updates, and remain cautious about scams that target information other than login credentials.
The significant change since Google's 2024 announcement is that passkeys are increasingly becoming a normal sign-in method rather than an experimental alternative. Their phishing-resistant design addresses one of the biggest weaknesses of passwords, while systems such as Cross-Account Protection aim to contain security problems that can spread between connected online accounts.
0 Comments