Should I use "sign in with Google" or "sign in with Apple"?
What social sign-in actually shares, why it is usually safer than another password, the single-point-of-failure problem, and where it is worth refusing.
- Difficulty
- beginner
- Time
- 10 min
- Read
- 3 min
- Safety
- caution
Short answer
Usually yes, with one condition: the account you sign in with must itself be properly protected, because it becomes the key to everything. Social sign-in avoids another reused password, shares less than people assume, and can be revoked centrally. Avoid it for anything you may need to keep if you leave that ecosystem, and for work-critical accounts.
The buttons offering to sign you in with Google, Apple, Microsoft or Facebook use a delegation standard: the site never sees your password, and instead receives a token confirming that the provider authenticated you, plus whatever profile details you allow. It is a genuine security improvement over yet another password, with one real trade-off.
Safety
Step by step
- Understand what is and is not shared.The site gets a confirmation that you are signed in, plus a stable identifier and usually your name and email address. It does not get your password and it cannot read your mail, contacts or files unless it separately asks for those permissions and you grant them.
- Read the permission screen, once, properly.Most requests are just profile and email. If a site asks to read your contacts, your calendar or your files to let you sign in, that is not sign-in, it is data collection. Refuse and use an email address and password instead.
- Weigh the single point of failure.Everything behind that account depends on it. If it is locked for a terms violation, closed, or compromised, you lose the lot at once. That is the real cost, and it is why the underlying account has to be strongly protected.
- Protect the underlying account properly first.Unique password in a manager, an authenticator app or passkey rather than SMS, recovery codes saved on paper, recovery email and phone up to date. Do this before you spread it across dozens of services.
- Prefer Apple's hide-my-email where offered.It gives each site a unique relay address rather than your real one, which limits marketing, limits breach exposure, and lets you cut off a single site without affecting the others.
- Avoid it where portability matters.Anything tied to a job, a business, a domain you own, or a service you would keep if you moved between Apple and Android. Those deserve their own email address and password so they are not hostage to an ecosystem.
- Review the connected apps list periodically.Both Google and Apple list every service connected to your account and let you revoke any of them. Once a year is enough, and it is a fast way to find services you had forgotten.
- Know what happens if you revoke.Revoking a connection can lock you out of that service unless it lets you set a password separately. Set a password on the important ones as a fallback before you revoke anything.
Alternatives
- Email address and unique password in a manager: Independent of any ecosystem, portable, and no single point of failure. Requires a password manager to be practical, and every site is another breach exposure.
- Sign in with Apple: Strong privacy defaults and the option of a per-site relay email address. Best inside the Apple ecosystem; awkward if you later move to Android.
- Sign in with Google: The most widely supported, with a good security model and a clear connected-apps list. Concentrates everything on one account, so protect it accordingly.
- Sign in with Facebook: Widely supported and the weakest choice of the three. Account lockouts and closures are common and support is limited, so a lockout takes everything with it.
Questions people ask
Can the site see my emails or files?
No, not from sign-in alone. It receives an identity confirmation and basic profile details. Anything more requires a separate permission that you would have to approve on the consent screen.
What happens if I lose access to the Google or Apple account?
You lose access to every service you signed into with it, unless each of those lets you set a separate password. That is the strongest argument for protecting the underlying account thoroughly.
Is it more private than an email and password?
Sometimes. It shares less with the site than a form does, and Apple's relay email is a genuine privacy gain. But it tells the identity provider which services you use.