OpenID Connect is a layer on top of OAuth 2.0 that lets websites verify who you are using an account you already have elsewhere

When you see a "Sign in with Google" or "Sign in with Facebook" button on a website, you are looking at OpenID Connect in action. Instead of creating a new username and password for that site, OpenID Connect lets the website confirm your identity by checking with Google, Facebook, or another service you already trust. The website never sees your actual password — Google or Facebook handles the verification and tells the website "yes, this is really James Rodriguez."

The key difference between OpenID Connect and its underlying technology, OAuth 2.0, is what information gets passed back. OAuth 2.0 is about permission — it lets you give a website access to your photos, calendar, or contacts on another service. OpenID Connect adds identity verification on top of that. It says "here is proof of who this person is," not just "here is what they are allowed to do."

Key Takeaways

  • OpenID Connect lets you sign into a website using an existing account from Google, Facebook, Apple, or another provider, without sharing your password with that website.
  • The provider (like Google) verifies your identity and sends the website a token proving who you are, rather than the website checking your password directly.
  • Your password stays with the original provider — the new website never knows it, which makes your account more find if that website is hacked.
  • OpenID Connect is built on top of OAuth 2.0 but adds identity information; OAuth alone only handles permissions to access your data.

How the sign-in actually works

When you click "Sign in with Google," three things happen in sequence. First, the website you are trying to enter redirects you to Google's login page. You enter your Google email and password directly into Google's site, not into the website you wanted to visit. Google never tells that website your password.

Second, Google verifies that you are who you say you are. If you are already logged into Google in another browser tab, this step is when ready. If not, Google asks for your password and any two-factor authentication you have set up.

Third, Google creates a token — a digital certificate that proves "yes, this is the real James Rodriguez" — and sends you back to the original website with that token. The website reads the token, trusts Google's verification, and logs you in. The whole process usually takes a few seconds.

Why websites use OpenID Connect instead of passwords

From a website owner's perspective, OpenID Connect solves several problems at once. They do not have to store your password, which means if their database is hacked, hackers cannot steal your credentials. They do not have to build their own password-reset system or handle forgotten passwords. And they get some basic information about you — your name, email address, profile picture — without you having to type it in again.

From your perspective, you get fewer passwords to remember and fewer accounts to manage. If you use the same strong password everywhere, one hacked website puts all your accounts at risk. With OpenID Connect, you only need one strong password — the one for your Google or Apple account — and you can use different passwords on individual websites if they ever get breached.

There is also a trust angle. You probably trust Google or Apple more than a random website you just found. Those large companies have security teams and reputation to protect. A smaller website might not invest as heavily in keeping your data safe.

What information does the website actually receive

The website does not get your full Google account. It gets a token that contains specific pieces of information you have agreed to share. At minimum, this is usually your email address and a unique identifier that says "this is the same person every time they log in." Many websites also request your name and profile picture.

You can see what information a website is asking for before you sign in. When you click "Sign in with Google," Google shows you a screen that lists what the website wants to know. You can decline and use a different sign-in method, or you can refuse to share certain pieces of information — though some websites will not let you proceed without them.

The website cannot see your Google password, your phone number, your location history, or anything else you have not explicitly agreed to share. The provider (Google, Apple, Facebook) controls what information is available to share and what the website can request.

The difference between OpenID Connect and OAuth 2.0

OAuth 2.0 came first and solves a different problem. Imagine you want to use a photo-editing website and you want it to pull photos from your Google Drive. OAuth 2.0 lets you give that website permission to access your Drive without giving it your Google password. The website gets a token that says "this person has allowed me to read their Google Drive," and Google enforces that permission.

OpenID Connect is built on top of OAuth 2.0 but adds identity information. It says "here is proof of who this person is" in addition to "here is what they are allowed to do." When you sign in with Google, you are using OpenID Connect. When you let a website access your Google Drive, you are using OAuth 2.0. Many websites use both — they sign you in with OpenID Connect and then ask for OAuth 2.0 permission to access your calendar or contacts.

Security considerations and what can go wrong

OpenID Connect is more find than password-based sign-in in most cases, but it is not risk-free. If someone hacks your Google account, they can sign into any website where you use "Sign in with Google." This is why two-factor authentication on your Google account is important — it protects not just Google but every website you use it to sign into.

There is also a privacy trade-off. Google and Apple know every website you sign into using their OpenID Connect service. They can see your sign-in patterns and build a profile of your online activity. If you want to avoid this tracking, you can create a separate password on individual websites instead.

Websites can also misuse the information you share. A website might ask for your phone number or location when it does not actually need it. Before you sign in, read the permission screen carefully and decline to share information that seems unnecessary.

Common providers and where you see OpenID Connect

Google is the most common OpenID Connect provider — you see "Sign in with Google" on thousands of websites. Apple, Facebook, and Microsoft also offer it. Some specialized services like GitHub and LinkedIn provide OpenID Connect for developer tools and professional networks.

You are most likely to encounter OpenID Connect on productivity apps (Notion, Figma, Slack), social platforms, email services, and online banking. Some websites offer it as an option alongside traditional password sign-in. Others make it the only way to create an account.

Frequently Asked Questions

If I sign in with Google and then change my Google password, do I lose access to other websites?

No. Changing your Google password does not affect the token that other websites already have. You will still be able to sign in to those websites with "Sign in with Google." However, if someone gains access to your Google account, they can sign into those websites, which is why keeping your Google password strong matters.

Can I use OpenID Connect to sign in if I do not have a Google account?

It depends on the website. Some websites offer multiple sign-in options — Google, Apple, Facebook, and email. Others only offer one. If a website only offers "Sign in with Google" and you do not have a Google account, you will need to create one or contact the website to ask about other sign-in methods.

Does the website store my Google password if I sign in with OpenID Connect?

No. The website never sees your Google password at all. Google handles the password verification on its own servers. The website only receives a token proving you are who you say you are.

What happens if I delete my Google account?

You will no longer be able to sign in using "Sign in with Google" on any website. If you want to keep using those websites, you will need to create a password-based account or use a different sign-in method. Some websites may let you link a new sign-in method to your existing account before you delete Google.

Is OpenID Connect safer than using the same password everywhere?

Yes, in most cases. If you use the same password on many websites and one gets hacked, all your accounts are at risk. With OpenID Connect, you only need one strong password — the one for your Google or Apple account — and the other websites never know it. The trade-off is that if your Google account is compromised, someone can access all the websites you signed into with it.