Google is exploring a new method for account recovery that relies on digital identity credentials, aiming to address vulnerabilities in traditional recovery processes. The tech giant views this approach as a way to bolster the security benefits of passkeys, which, while secure, can pose challenges if users lose their devices and lack alternative authentication methods.
According to Claire Forszt, product manager for authentication and account recovery at Google, weak recovery procedures can undermine the security advantages of passkeys. “If a passkey can be recovered with a lower security bar than the passkey holds, then the security benefit essentially becomes moot,” she said during a talk at Authenticate 2026. Google aims to integrate passkeys with robust account recovery technologies to ensure users can securely access their accounts.
Digital credentials offer a secure recovery option. Google anticipates that digital IDs will become widely adopted globally by 2030 and could account for up to 50 percent of all account recovery methods by 2035. In Google’s proposed system, users register a signed digital identity credential in advance, which generates a unique cryptographic identifier linked to their account. If a user loses their device, they can obtain a new digital identity credential after verifying their identity with the issuing authority.
Bill Chen, product manager at Google, emphasized the potential of digital IDs to restore users’ digital lives, including passkeys, accounts, apps, and data. However, he noted several hurdles, such as the need for provisioning during device setup, near-real-time provisioning, adoption by credential managers, and public-private partnerships to build social acceptance of digital IDs for recovery. Despite these challenges, Google believes its system could eventually allow users to recover their digital lives even if they lose all devices and credentials.
Legacy recovery methods are expected to persist for the foreseeable future. By 2035, Google predicts that phone numbers will still account for 20 percent of account recovery methods, followed by selfie biometric verification at 15 percent and recovery codes at 10 percent. The company acknowledges that its digital identity system is not yet ready for wide market deployment due to challenges like the speed of credential issuance and technical interoperability among digital wallets, operating systems, credential issuers, and credential managers.