Yes, mostly, and it is almost certainly safer than what you would otherwise do, which is invent a password you have used on four other sites.
It also hands you two problems that nobody mentions at the moment you tap the button. Neither is a reason to stop using it. Both are reasons to use it deliberately instead of by reflex.
What the button actually does
It does not give the app your Google password. That is the part worth understanding, because it is the part people worry about and the one thing that genuinely is not happening.
When you tap it, Google confirms to the app that you are who you say you are, and passes across a limited set of details. For a basic sign-in that is your name, your email address and your profile picture. The app gets a token, the token says Google vouches for this person, and your password never leaves Google.
The app can ask for more. Your contacts, your calendar, files in your Drive, the ability to send mail as you. When it does, Google shows you a consent screen listing what is being requested. That screen is the whole security model, and it is the screen everybody taps through in half a second.
So: read it. If a photo editing app wants your contacts, the answer is no, and the answer being no is the entire reason the screen exists.
Problem one: concentration
Every account you attach to Google becomes a room with the same door. That door is well made, and it is still one door.
Lose the Google account and you do not lose one thing. You lose every service you signed into with it, at the same moment, including the ones you forgot you attached. Password reset emails for your remaining accounts go to that mailbox too, which means whoever holds it can work through the rest at their leisure.
The answer is not to stop using it. The answer is that the Google account itself has to be defended at a completely different level from everything else you own:
- A passkey or a hardware key on it, not a text code
- A password used nowhere else, ever
- Recovery phone and recovery email both current, because an out of date recovery path is how people lose accounts permanently
- A look through your connected apps twice a year
Working out what is attached to your main account, and cutting the things that should not be, is one of those jobs that stays undone because nobody has an order to do it in. The Privacy Master Kit has that order, along with the audit for what your accounts are leaking about you. $11.99.
Problem two: the trail
Google learns which services you use and roughly when you use them. It does not see what you do inside the app, and it does see the shape of your life at the login layer.
Whether that matters is a judgment call rather than a security fact. For a shopping site, probably not. For anything you would rather Google had no record of your relationship with, use an email address and a password instead. Health services, dating, legal help, anything political, anything you would not want surfacing in an account activity list.
This is the part where most advice either shrugs or panics. Neither is useful. Decide per service, and notice that the decision is available to you.
When to use it and when not to
Use it for:
- Services you use often and want protected by your strongest account
- Sites where you would otherwise reuse a password, which is most people most of the time
- Anything low stakes where a fast sign-in is the point
- Any site that looks like it might have a shaky login system of its own, because Google’s is better than theirs
Skip it for:
- Anything financial. Banks and brokerages should have their own credentials and their own two-factor
- Services you want no cross-record of
- Anything you may want to hand over, sell or transfer later
- A work account you would lose access to along with the job
Never use it when the consent screen asks for scopes the app has no business needing. That is not caution, it is reading.
The exit is worse than the entrance
The awkward truth about these buttons is that leaving is harder than arriving.
Some services let you set a password afterwards and detach cleanly. Some tie the account to the Google identity permanently, and the only way out is deleting and starting over, losing your history with them. You cannot tell which kind you are dealing with at the moment you sign up.
If the account is something you expect to keep for years, that is an argument for a real password from the start. If it is a tool you are trying out, the convenience wins and the lock-in does not matter.
If you already used it everywhere
Most people reading this have thirty or forty services attached and no memory of most of them. The cleanup is straightforward and worth an evening.
- Open myaccount.google.com, Security, then “Your connections to third-party apps and services.” This is the full list, and it is longer than you expect.
- Sort into three piles as you read. Still using it. Not using it. No idea what this is.
- Revoke everything in piles two and three. If you were wrong, the service asks you to sign in again next time and nothing is lost. Revoking is reversible, which makes this low-stakes work.
- For the ones you keep, check the permissions. A service holding “read, send and delete your mail” when it only needed your name is worth removing and re-adding with less.
- Move your financial accounts off, one at a time, where the service allows a password instead.
Put a recurring reminder in for six months. The list regrows, because every new app asks and tapping the button is the path of least resistance.
The bottom line
Sign in with Google is safe, in the sense that matters: your password stays with Google and the app never sees it. Used instead of a reused password, it is a clear improvement.
Read the consent screen instead of tapping through it. Defend the Google account itself like the master key it has become, with a passkey rather than a text code. Keep your bank and anything you want no record of on separate credentials. Then prune the connected apps list twice a year, because the risk is never the button, it is the forty things you attached to it and forgot.