A Google passkey and 2-Step Verification work together, but they do not always produce a password screen followed by a separate code. Google treats a successful passkey sign-in as a protected flow that can satisfy the second-step requirement.
When you sign in with a password
With 2-Step Verification enabled, Google normally asks for an additional supported verification step after the password. Depending on the account and challenge, that can involve a prompt, a code, a key, or another permitted method.
The methods offered depend on the request and organization policy. Having enrolled a phone number does not guarantee that SMS appears for every sensitive action.
When you sign in with a passkey
A passkey proves access to the credential through a device or security key and its legitimate unlock process. Google’s guide says it bypasses a separate second authentication step, including for accounts with 2-Step Verification or Advanced Protection.
The absence of a separate SMS code therefore does not, by itself, show that 2-Step Verification was turned off. Check the account’s saved security settings rather than judging only from one screen sequence.
Adding a passkey does not delete your other factors
Google says enrollment does not remove existing authentication or recovery methods. Keep suitable independent backups and review the method list when replacing a device.
Passkeys also differ from a recovery phone or a recovery contact. A method used to sign in and information used to recover an account are related protections, not interchangeable settings.
Check the password-first preference
Creating a passkey normally enables a passkey-first experience. You can review Skip password when possible if you prefer a password first. A registered passkey can still be useful for the second step.
For Workspace, the administrator may allow passkeys for verification without allowing them to replace the password entirely. Follow the organization’s permitted flow.
Protect the credential’s device
Only create passkeys on devices you control. Somebody able to unlock a shared device may be able to use its passkey, and an ordinary browser sign-out is not always sufficient to revoke that access. Remove lost-device credentials and sessions through Google’s supported instructions.
Browse Gmail & Google Account help
References
- Sign in with a passkey instead of a password
- Turn on 2-Step Verification
- Get Google's strongest account security with the Advanced Protection Program
Reviewed against the linked official and developer guidance on October 27, 2026. Available options and screen labels can vary by account, device, region, and organization policy.