Whose passkey belongs on the family laptop?

Start with the unlock, not the account name

Picture a common household scenario for our first hypothetical case. Two siblings share a family laptop for schoolwork, both logging into the same computer account with the same device password, though they maintain entirely separate personal Google Accounts. One sibling signs into their private account to check an assignment and encounters an on-screen prompt inviting them to create a passkey for faster sign-in. Their account names and emails are distinct, but both children know the laptop unlock code by heart.

Google advises creating passkeys only on personal devices you control: someone who can unlock a device may be able to use a passkey saved there even after you sign out of Google. The account name on a setup prompt identifies the account receiving the credential. It does not establish who else can unlock or use the device where that credential will be saved. That is the household question to answer before accepting.

This is a different problem from a fraudulent website asking for a password. Passkeys are tied to the service for which they were created and offer phishing resistance. Here, the website may be genuine, while the person using the shared unlocked device is someone else. I would keep both questions in view: is this the real service, and who can use the sign-in method or session left on this computer?

Choose between using a passkey and leaving one behind

A personal phone with a private screen lock offers a different access arrangement from a computer that everyone unlocks with the same code. On supported devices, Google’s official passkey sign-in process can let you approve a computer sign-in using a passkey on your phone. That process uses the on-screen instructions and nearby-device communication, including Bluetooth. It is a way to use an existing credential, distinct from creating another one on the computer.

Read the choice on the actual sign-in screen before acting. A prompt to use a phone credential is not the same as a prompt to create one on the computer. Follow the official flow you started; do not scan a code from a stranger's message simply because it carries a familiar logo. If the options differ from the current help page, stop and check the requirements instead of trying unrelated codes or approving a request you cannot identify.

Before accepting a prompt, read whether it asks to use an existing passkey or create and store one. Decline creation on a borrowed computer. After using an account there, sign out and close any private browsing windows you used. Do not save credentials or leave downloaded private files behind. A private window reduces what that browser retains, but it does not make an untrusted or compromised computer safe for sensitive activity.

If the passkey already exists where it should not

Mistakes happen in busy households, and someone may have already tapped through a setup wizard on a shared machine, accidentally embedding their personal passkey into a device used by others. Remediation requires going directly to the source. From a trusted personal device, open your account settings, navigate to passkey management, and inspect the complete list of registered credentials to find the unwanted entry.

Google documentation notes that removing an unwanted passkey from your account settings is the primary step, but you must also follow specific credential manager instructions if a local copy remains cached on the foreign hardware. For certain automatically created Android passkeys, support guidelines direct you to sign the device completely out of the Google account. Always check the specific entry details rather than guessing from a generic display name.

Reviewing your signed-in devices should be handled as a separate administrative step from deleting passkeys. Removing a sign-in method and ending an active browser session solve entirely different security vulnerabilities. Always keep another reliable recovery method available, such as backup codes or a trusted phone number, before making sweeping changes to your active authentication inventory.

The false comfort of browser profiles

Browser profiles are useful for separating bookmarks, history and everyday browsing. They are not the same thing as separately locked computer accounts. On a shared operating-system login, another person may be able to switch into your browser profile or use a session you left open. I would check the actual device and browser arrangement rather than treating a different avatar as evidence that personal accounts are isolated.

A profile may also use a credential manager with its own rules for unlocking and synchronization. Those rules vary, so do not assume that every credential is visible or that every profile is securely separated. Ask the practical question instead: can another household member sit at this unlocked computer and reach your signed-in account? If the answer is yes, changing a profile picture or giving the profile your name does not resolve it.

In a hypothetical example, a parent finishes reading email on the shared laptop and switches to the teenager’s browser profile without signing out. Returning to the parent’s profile may reveal the still-open mailbox without using a passkey at all. This is why the discussion should cover saved sign-in methods and existing sessions separately. The first helps someone sign in again; the second may let them continue a visit that never ended.

A signed-in session is a separate thing to close

A saved credential helps start a visit to an account. A signed-in session lets that visit continue. You can understand the distinction without inspecting cookies or other technical storage. If the mailbox opens when the next person returns to the browser, there may be no new sign-in to approve at all. Ask what remains accessible after you finish, as well as what could be used to sign in again tomorrow.

Using a phone passkey for a supported cross-device sign-in does not itself save that passkey to the computer. It does, however, establish a signed-in session there. That session is useful while you work and needs attention when you finish. Sign out through the service and follow its borrowed-device guidance. Avoid assuming that the use of a phone credential means nothing private was displayed, downloaded or retained on the computer.

Creating a passkey on the computer is a separate action that can leave a reusable sign-in method available under the relevant device or credential-manager controls. Signing out of the website does not necessarily remove it. If you did create one unintentionally, inspect the account’s passkey settings and the manager that stores it. Keep a working alternative before removing an entry, and read the service’s instructions for that kind of credential.

Establishing meaningful family boundaries

Agree which household services are intentionally shared and which accounts should be signed out after use. An adult's private email and a shared entertainment service may need different arrangements. Tell children that a visible account is not an invitation to use it. The rule should apply to adults as well: convenience is easier to manage when everyone knows which access is deliberate and which was left behind by mistake.

Separately locked operating-system accounts can provide a more useful household boundary than browser profiles alone, but the arrangement still depends on account privileges, device configuration and whether people leave sessions unlocked. Do not use that observation as a promise that shared hardware is equivalent to a personal device. Keep especially sensitive accounts on a device you control when possible, and lock the computer when stepping away from an active session.

A practical closing routine can be short: finish the task, sign out of the personal service, close the temporary browser window and check for downloaded private files. A separate personal device may be preferable for sensitive tasks, but not every family has one for each person. Where sharing is necessary, explain the limits openly and use the controls your actual equipment supports rather than assuming a different avatar creates privacy.

Frequently asked questions

Putting it into practice

On the family laptop, I would make two checks: where could someone sign in again, and where are they already signed in? Keep passkeys under personal control, use the supported phone flow when appropriate and close temporary sessions when finished. If a credential was saved in the wrong place, review it through the official account and credential-manager instructions while preserving another way to sign in.