Google is testing selfie sign-in: your face instead of a password and an SMS code

A forgotten password, or an SMS code that refuses to arrive, is the most common reason signing into an account turns into a multi-minute ordeal. Google just announced a test of a fix for exactly that problem, and it's a different approach than you might expect: a short selfie video is meant to replace the password and one-time code as a way to confirm your identity when signing in.

This isn't another password manager or a new step bolted onto two-factor authentication. Google is testing something more fundamental: swapping out the password itself for your face, specifically in the situations where you'd normally have to recall it.

How selfie sign-in is supposed to work

The principle is simple from the user's point of view: instead of typing a password or waiting for an SMS code, you record a short video of your face directly in the browser or the Google app. The system analyzes it on-device and compares it against data saved earlier for that account, to confirm the sign-in attempt is genuinely coming from the account owner, not someone who happens to know the password or intercepted the code.

How this differs from Face ID

The most important difference compared to something like Face ID on an iPhone is where and for what the data gets used. Face ID unlocks one specific device and works entirely locally, it has nothing to do with signing into a cloud account from different hardware. Google's selfie sign-in serves the opposite purpose: confirming identity for an account you might be trying to recover, or signing into from an entirely new device that has never had your biometrics saved on it before.

It's precisely that second scenario, signing in from a new device or recovering access after losing a password, that generates the most frustration and the most fraud attempts at once today. An SMS code can be intercepted through a SIM swap, and security questions like "mother's maiden name" stopped being a real safeguard a long time ago, since that kind of information is often findable publicly.

What about privacy

The question that comes up immediately: what happens to the face recording itself. Google states the analysis is designed to be privacy-preserving, without permanently storing the raw video for employees to review or for purposes beyond identity verification. That's a meaningful statement, but it's worth remembering this is still an early test, not a fully documented, finished product with detailed, publicly available technical documentation of exactly how the data is stored and for how long.

Face biometrics differ from a password in one significant way: a password can be changed if it leaks. A face cannot be changed. That means any biometrics-based solution demands a higher level of trust in how the company secures the data than a classic password does, and that's exactly the part that will get scrutinized most closely before the feature reaches a wider group of users.

Who benefits the most

The biggest winners here are people who regularly sign in from multiple different devices, a shared family computer, a work machine, or a tablet borrowed from someone else, where a password manager's saved credentials aren't automatically available. Those are exactly the moments that generate the most frustration: recalling a password you rarely type manually, or waiting on an SMS code that sometimes arrives late or doesn't arrive at all because of a carrier issue. A selfie video sidesteps both problems at once, since it requires neither remembering anything nor having a phone on hand capable of receiving a message.

On the other hand, for someone already using a password manager and passkeys, the benefit is considerably smaller, since those solutions already effectively eliminate the need to type a password manually. Selfie sign-in looks more like an addition to Google's existing security ecosystem than a replacement for the best methods already available today.

SPAWNSY verdict