Google is pushing a major security overhaul, urging 2.5 billion users to ditch passwords for passkeys due to increasing cyber threats. But millions of user accounts could be left vulnerable if they do not adhere to this. The rollout, all prepared for January 2026, is aimed at making passkeys the default login, flashing prompts to upgrade during sign-ins.
Passwords switch unsafe passwords for device-bound cryptographic keys, using biometrics or PINs, putting an end to typing or phishing baits. Google’s Password Manager syncs them encrypted across devices for seamless Gmail access. According to Google’s Christiaan Brand, “Technological transformations do not occur instantly, especially in the realm of security. However, as passkey adoption reaches a tipping point, its global influence will be significant.”
Since the 2023 rollout, passkey uses exploded 352% year-over-year, making it the largest real-world deployment ever. Dashlane stated,
Google passkey authentications exploded by 352% over the past year, driven by a pivotal product decision: In October 2023, Google made passkeys the default login option for personal Google Accounts. This move effectively exposed hundreds of millions of users to passwordless authentication, creating the largest real-world deployment of passkeys to date.
Legacy setup can also expose millions of accounts – Gmailfy and POP3 fetching third-party emails from Yahoo, Hotmail, etc., ends January 2026, dropping spam or malware detection on those messages. This can lead to unfiltered emails flooding the inbox, making it exposed to phishing.
A weekend glitch in January 2026 has already overwhelmed inboxes with spam, undelivered messages, and other inconveniences. Google fixed it, but the tech giant also warned users of persistent misclassifications during its investigation. Google added, “Our AI-enhanced spam-filtering capabilities block nearly 10 million spam emails every minute,” but legacy forwarding loses that security.
As a user, head to Google Account security settings to enable passkeys, let auto-fill handle the rest. Manually forward legacy emails, turn on two-factor authentication (2FA). Many are persistently falling back into old habits of passwords, but it’s not advisable. Some of the drawbacks include that shared devices can risk password leakage, lost devices need recovery, and social engineering targets cloud sync.
Introducing passkeys to your account demands vigilance but eliminates phishing. Google’s effective upgrade might not be convenient, but it fortifies Gmail accounts against scams and breaches. Millions have already upgraded, and time’s ticking for the rest.
Related: WhatsApp Unveils ‘Strict Account Settings’ To Amp Up Cybersecurity Measures