Almost five months after adding passkey support to Chrome, Google has begun rolling out passkeys to Google Accounts across all major platforms. According to codelivly.com (originally reported by The Hacker News), the change gives everyday users a more phishing-resistant option to replace the old typed-password routine.
At a glance:
- Passkeys are now rolling out for Google Accounts on all platforms.
- They use device biometrics or a local PIN instead of a password.
- Passkeys are resistant to phishing attacks by design.
- They sync across devices on the same OS but not across platforms.
- Google will continue supporting passwords and 2FA for the foreseeable future.
How Google passkeys work
A passkey is a FIDO-standard credential tied to your device. When you create one for your Google Account, you unlock it with whatever your device uses for biometric or PIN authentication: fingerprint, face scan, or screen lock PIN.
The reference article cites Google saying the key itself stays on the user's hardware and never gets transmitted to anyone else. The device generates the cryptographic pair; the private half never leaves. To sign in, you prove you can unlock the device.
That's a different security model from passwords. Passwords can be phished, guessed, leaked, and reused. Passkeys can't be phished because they don't leave your device, and they can't be guessed because there's nothing to type.
Sync is per-OS, not cross-platform
Here's the catch. According to codelivly.com, a passkey created on one device will sync to other devices running the same operating system, as long as they're signed into the same account. So Android-to-Android syncs through Google Password Manager. IOS-to-iOS and macOS-to-macOS sync through iCloud Keychain. Windows syncs through Windows Hello.
But Android-to-iOS or Android-to-Windows? No. They're separate ecosystems with separate sync systems.
That's a meaningful limitation for users who mix devices. If you sign in on a Mac but only have a passkey on your Android phone, you'll need the cross-device sign-in flow.
Cross-device sign-in: the workaround
According to codelivly.com, if you try to sign in on a new device that doesn't have the passkey, you can pick "use a passkey from another device." The new device uses Bluetooth proximity to confirm your phone is nearby, sets up an encrypted connection over the internet, and asks you to approve the sign-in with your phone's biometrics.
The new device never receives the passkey itself. It just gets a one-time signature for that single sign-in. That keeps the security model intact while still letting you sign in on a borrowed machine or a new laptop.
End-to-end encryption is critical here. Both Google Password Manager and iCloud Keychain encrypt passkeys with keys only your devices can derive, so neither provider can read them. That's why a lost phone doesn't mean losing your passkeys, as long as your account has other devices or you've set up recovery.
What Google recommends (and warns against)
According to codelivly.com, Google is advising users not to create passkeys on devices shared with other people. The warning is real: if someone else can unlock your shared device, they can sign in as you. A passkey on a shared laptop is worse than a strong password.
The recommendation is straightforward: enable passkeys on your personal phone, your personal laptop, and nowhere else. Shared devices, work machines, and family computers should keep using passwords (ideally with 2FA).
Google has also said passwords and 2FA aren't going away. Passkeys are additive. You can adopt them gradually, keep your existing password as a fallback, and migrate fully when you're ready.
Worked example: setting up a passkey on a Pixel
Say you've just bought a Pixel 8 and want to use passkeys for your Google Account. Steps:
- Go to myaccount.google.com and sign in with your password.
- Navigate to Security > Passkeys and security keys.
- Tap "Create a passkey." Your phone will prompt for fingerprint or face unlock.
- Confirm. The passkey is now stored locally and synced via Google Password Manager.
Next time you sign in on a new device or session, you'll see the option to use your passkey instead of a password. Approve with your fingerprint and you're in.
If you lose the phone, sign in on another device and remove the passkey from your account. You can create a new one on your replacement device.
Our analysis
Passkeys are the right answer for the password problem. They're resistant to phishing, can't be reused across sites, and don't require users to remember anything. The friction is real but manageable: device loss, cross-platform sync gaps, and shared-device risks.
The Android ecosystem is in a strong position here. Google Password Manager handles sync, Android has solid biometric APIs, and Chrome supports passkey flows natively. According to codelivly.com, the rollout is now live, so most users can adopt passkeys today.
What to watch next: cross-platform passkey portability. The FIDO Alliance has working drafts for syncing passkeys across ecosystems. Until that lands, mixed-device users will keep hitting the cross-device sign-in flow.
Bottom line: turn on passkeys for your Google Account on your primary Android phone. Keep passwords as fallback. Don't enable passkeys on shared devices.
Key takeaways
- Passkeys replace passwords with device-bound cryptographic keys.
- They're phishing-resistant by design and can't be reused.
- Sync works within one OS but not across platforms.
- Use the cross-device flow for signing in on unfamiliar machines.
- Never enable passkeys on shared devices.
Frequently asked questions
What is a passkey?
A passkey is a FIDO-standard credential that uses your device's biometric or PIN authentication instead of something you type. It's tied to your hardware and can't be phished.
Where are passkeys stored?
According to codelivly.com, passkeys live on your device and sync via Google Password Manager (Android), iCloud Keychain (Apple), or Windows Hello (Windows). They are end-to-end encrypted.
Do passkeys work across Android and iPhone?
Passkeys sync within one OS family but not across platforms. For cross-platform sign-in, use the "use a passkey from another device" Bluetooth flow.
Can I still use my password?
Yes. Google has said passwords and 2FA will continue to be supported for the foreseeable future. Passkeys are additive, not a forced replacement.
What happens if I lose my phone?
Sign in on another device and remove the lost phone's passkey from your Google Account. Create a new passkey on your replacement device.