You may not realize it, but passwords are the single biggest threat to your online security – they’re easy to steal, they’re hard to remember, and managing them is tedious. Many people believe that a password should be as long and complicated as possible – but in many cases, this can actually increase the security risk. Complicated passwords tempt users into using them for more than one account; in fact, 66% of Americans admit to using the same password across multiple sites, which makes all those accounts vulnerable if any one falls. 

In 2020, searches for “how strong is my password” increased by 300%. Unfortunately, even the strongest passwords can be compromised and used by an attacker – that’s why we invested in security controls that prevent you from using weak or compromised passwords. 

At Google, keeping you safe online is our top priority, so we continuously invest in new tools and features to keep your personal information safe, including your passwords. 

On World Password Day,  we’re sharing how we are already making password management easier and safer, and we’re providing a sneak peek at how our continued innovation is creating a future where one day you won’t need a password at all. 

One of the best ways to protect your account from a breached or bad password is by having a second form of verification in place – another way for your account to confirm it is really you logging in. Google has been doing this for years, ensuring that your Google Account is protected by multiple layers of verification.

Today we ask people who have enrolled in two-step verification (2SV) to confirm it’s really them with a simple tap via a Google prompt on their phone whenever they sign in. Soon we’ll start automatically enrolling users in 2SV if their accounts are appropriately configured. (You can check the status of your account in our Security Checkup).  Using their mobile device to sign in gives people a safer and more secure authentication experience than passwords alone.

We are also building advanced security technologies into devices to make this multi-factor authentication seamless and even more secure than a password. For example, we’ve built our security keys directly into Android devices, and launched our Google Smart Lock app for iOS, so now people can use their phones as their secondary form of authentication. 

Keeping Your Passwords Safer Everywhere 

For as long as passwords remain a part of your digital life, through the apps you use and the websites you access, we will continue to innovate and develop new products and technologies that make managing them easy, and most importantly secure by default.

Our Password Manager, built directly into Chrome,  Android and now iOS, uses the latest security technology to protect your passwords across all the sites and apps you use. It makes it easier to create and use complex and unique passwords, without the need to remember or repeat them. Every time you go to a site or sign in to an app while logged into your Google Account, Password Manager can automatically populate your secure password. Password Manager is also integrated into our single-click Google Security Checkup — which tells you if any of your passwords have been compromised, if you are reusing passwords across different sites, and the strength of your passwords. We also automatically inform you if your password has been compromised, so you can make a quick and easy change to keep your information safe. 

We’ve recently launched our new Password Import feature which allows people to easily upload up to 1,000 passwords at a time from various third party sites into our Password Manager (for free).  By taking this step you can ensure that all of your passwords are protected by our advanced security and privacy technology. 

Features like Password Import, Password Manager and Security Checkup — combined with authentication products like Sign-in with Google — reduce the spread of weak credentials. All are examples of how we're working to make your online experience safer and easier—not just on Google, but across the web. 

One day, we hope stolen passwords will be a thing of the past, because passwords will be a thing of the past, but until then Google will continue to keep you and your passwords safe. Visit our Safety Center to learn all the ways we’re making every day safer online.

Using a strong password without recycling it on different accounts, exchanging personal information only on encrypted sites, keeping your software up to date: these tried-and-true tips have never been more important for staying safe online. But this Safer Internet Day, we wanted to give some insight into how our systems help keep you safe, automatically—on Google and beyond. No switches to flip or buttons to click, these protections always have your back.

Outsmarting phishing to protect your Google Account

Luckily, we’ve built lots of smart armor into Gmail to automatically zap scammy messages before you ever see them. Our systems anonymously examine thousands of signals across all of Gmail—where a message originated, to whom it’s addressed, how often the sender has contacted the recipient in the past—to determine which messages are safe, and which ones aren’t. We then filter the vast majority of this nasty stuff out; the average Gmail inbox contains less than 0.1 percent spam.

Still, across the internet, the bad guys can be pretty clever. For example, a fraudster could steal your username and password because you accidentally shared them on an especially deceptive scam site. But, even if attackers have your credentials, our systems are still able to block them and keep your account safe, something we did hundreds of millions of times in 2016. That's because we aren’t just making sure you’ve typed the right password. We also look for subtler signals to confirm the sign-in doesn’t look funky: Are you using the same device that you usually use? Are you in a familiar location, or somewhere far away that you haven’t been to before? We want to make sure the sign-in attempt doesn’t resemble other concerning sign-in patterns that may be on our radar at any given time.

On the web, on Android: we've got you covered

We use similar security tools to help make the web and a huge variety of Android apps and devices safer too.

For example, have you ever clicked a link and seen a red warning, like this? That’s Safe Browsing at work, strongly suggesting you should avoid visiting a site because it probably contains “badness,” like malware or a phishing trap. Similar to the way we crawl the web to deliver search results, Safe Browsing crawls for bad stuff that might be harmful to you or your device. It’s always hard at work: We show tens of millions of Safe Browsing warnings every week on more than 2 billion devices, across a variety of web browsers.

For our Android users, we developed an “app analyzer” that builds on Safe Browsing’s technology to specifically hunt for dangerous Android apps, wherever they may be, and warn you before you install one. If an app doesn’t pass the app analyzer test, it won’t be allowed in Google Play. An additional protection, Verify Apps, runs directly on Android devices, proactively checking more than 6 billion apps and 400 million devices every day. It checks in when you install an app, returns frequently to make sure everything looks safe, and if something is amiss, can remove the app from afar.

Detecting the obvious badness—sites well-known for phishing scams, ransomware that locks your device until you pay a fraudster—is relatively easy. But the stealthier badness is only detectable by measuring billions of signals across sites and apps. If this sounds similar to the way we approach spam protections on Gmail or suspicious logins into Google, that’s because it is! The ability to understand badness on a large scale enables us to find the clues bad guys don’t even know they were leaving behind.

We have a responsibility to keep you safe on Google, and help make the web more secure as well. We’re constantly improving our automatic protections, but we want to give you the controls to adjust your security settings as well. With that in mind, celebrate Safer Internet Day by taking our two-minute Security Checkup to protect your account and adjust your security settings. You can also learn more about other ways to keep your Google Account secure at privacy.google.com.