Google's Advanced Protection Program Swaps Security Keys for Passkeys

Google's Advanced Protection Program (APP) has offered better security for high-risk users since its inception but always required a physical key for setup and use. A recent change, however, means you can now use passkeys to join and log in.

"Today, we're making it even easier for high risk users to enroll and use the program by making passkeys available in APP," Google wrote in a blog post.

Previously, APP required a physical security key that plugged into your device's USB port and generated a code that Google would use to authenticate you. Last year, Google started rolling out passkeys as a way to secure Google Accounts, but still required a physical key for the Advanced Protection Program.

"However, we understand that users might not always have access to physical security keys or the ability to buy one," Google says. "For example, this could be difficult for a journalist covering a war zone, a traveling campaign worker, or a business leader taking a last-minute trip."

A passkey is a pair of cryptography keys generated by your device. A public key and a private key combine to create a passkey that unlocks your account; no need for an extra gadget.

To try it our yourself, head to Google's APP landing page, click the Get Started button, and confirm your email address. You can then follow the steps to create a passkey. Google does require you to have a recovery email and recovery phone number just in case.

Recommended by Our Editors

How to Set Up Passkeys for Your Google Account

Passkeys: What They Are and Why You Need Them ASAP

Not Ready for Passkeys? Multi-Factor Authentication Is Still Better Than Nothing

Once set up, you can use biometrics on your Android phone or iPhone to log into your Google account as a multi-factor authentication method after you enter your password. The idea is that it replaces common sign-in systems like MFA or SMS verification with pins or biometrics from devices you have at home.

The APP promises "extra safeguards against common attacks like phishing, malware and fraudulent access to data." It's intended "for people at high risk of cyberattacks," so some of its features may be overkill for the average user.