Passkeys for email accounts
Short answer
A passkey can strengthen sign-in when supported by your provider. Keep device access and recovery options secure as well; do not add a passkey on a shared device.
What you need to know
Understand where passkeys help.
-
Device access matters
Google warns to create passkeys only on personally owned devices: someone who can unlock a device with a passkey may be able to sign in to the account. Do not add one to a shared or borrowed machine.
-
Passkeys are not app passwords
An older mail client’s credential field does not automatically accept a passkey. Use the provider’s supported client sign-in method. Review unfamiliar account credentials separately from the browser’s visible sessions.
Check, act, and the limit
-
Start by checking
Check the provider’s supported sign-in methods and listed passkeys.
-
Then act
Remove any passkey you did not create, then set up your own on trusted devices.
-
Know the limit
Passkeys are provider-specific and not every legacy mail client supports them.
Next guide: Set up two-factor protection for email
Official sources
Provider security pages this guide is based on. Product details change, so check them before acting.
- Google Account Help: secure a compromised account support.google.com
- Google Account Help: passkeys support.google.com
HackEmail is an independent guide. We never ask for your password or verification codes, never read messages and never access anyone’s inbox. Not affiliated with Google, Microsoft, Apple or Yahoo.