Is Google Chat safe and secure?

Google Chat may not be the sexiest messaging platform out there, but being built into Gmail and other elements of Google Workspace, it can be convenient for both office workers and others who want an alternative to services like Slack, WhatsApp, or Telegram. But how safe is it? Should you invest even more trust in Google than many of us already do?

That’s a complex question, as you might guess. We’ve broken down our answer into several sections, addressing different aspects of the service’s cybersecurity.

Overall, though, we feel fairly confident in saying “yes.” While no messaging service is completely immune from threats, you’re unlikely to encounter any serious problems on Google Chat. That’s thanks not just to Google’s security measures, but it being a less desirable target — there are a lot more potential victims on services like WhatsApp and Telegram.

It should be. Data is encrypted both in transit and at rest on Google servers, and as with other Google apps and services, there are functions designed to detect or block malware and phishing (fake website) threats. We do wish the company offered end-to-end encryption as with Google Messages (the texting app built into Android), but that might be less practical given the focus on permanent group chats (“Spaces,” as Google calls them). End-to-end technology is ideally suited to one-on-one conversations.

Google Chat has been breached in the past — an incident in 2020 exposed some private conversations. There don’t appear to have been any meaningful incidents since then however, so it seems like Google has sufficiently ramped up security.

There are some important privacy details to be aware of. While Google doesn’t use any Chat content for advertising, it does collect your location data for some features (including security), and of course it already has your Google account and Contacts data. It also collects some performance and crash info for analytics. If the company is served with an order from law enforcement or spy agencies, everything could be shared, whereas end-to-end encryption would prevent even Google from snooping on conversations.

One nice thing is that Google supports two-step verification (2SV). This is an optional feature, but should definitely be switched on, since it makes it much tougher for an attacker to hijack your account.

Relatively speaking. Like we said, it’s not a major target for criminals, since other platforms are more popular. It’s also oriented primarily at corporations and other organizations these days, so it’s unlikely that you’ll be approached by someone out of the blue.

That said, scams are still a possibility. We’ve got a more detailed guide to Google Chat scams, but here’s a short version of what to watch out for:

• Lotteries, giveaways, and other fake prizes. It should be taken for granted that people aren’t giving things away through Google Chat, much less for contests you don’t remember entering.
• Tech support scams. Google and other major tech companies will never approach you about things like viruses or account security through Chat.
• Friend, family, and similar impersonation scams. Be on the lookout for accounts with misspelled names and/or stolen images, especially if they immediately ask for money or want you to click a link.
• Job scams. No legitimate employer is hiring directly through Google Chat. At best a co-worker might discuss an internal promotion with you, or a friend might tip you off to a listing on a well-known site such as Indeed or LinkedIn.
• Romance/catfishing and prostitution scams. Unless you’ve already met someone, you should be immediately suspicious of flirting or solicitation on Google Chat.
• Miscellaneous phishing and malware attacks. These can include everything from get-rich-quick investment schemes to unprompted file transfer requests.

Frankly, you’re unlikely to talk to strangers in the first place. The service is mostly meant to keep you in touch with co-workers, or at least people listed in your Google Contacts. A stranger could potentially approach you with an messaging request, but you’d have to accept it before beginning conversation, and it’s probably a red flag if they’re not in your Contacts.

This setup keeps the service fairly safe for adult users, but if you’re still worried, the tips below should keep you bulletproof. We’d recommend steering kids and teens towards other platforms — not that you’ll have a hard time with that.

How to stay safe on Google Chat

These are tips that every Chat user should follow.

• Enable 2SV (two-step verification) on your Google account as soon as possible. Even if a hacker obtains your login info, they’ll probably be missing a device needed to authenticate their login attempt. If you get a 2SV prompt when you’re not trying to log in yourself, change your password immediately.
• If an offer or request comes from a previously unknown contact, it should automatically be suspicious. Google Chat isn’t designed for anonymous interactions. Generally, you should reject any stranger’s messaging request outright.
• Never click on links from unknown contacts. If you do somehow end up talking to a stranger, you should take a close look at any URLs (web addresses) they share — scammers rely on domains that sound official, but don’t actually match the organization they’re supposed to represent. Alternately, they may rely on URL shorteners that disguise a link’s destination.
• Never download files you haven’t specifically asked for. Google Chat simplifies file transfers, but if you’re not expecting them, they could contain malware or spyware.
• Real institutions won’t ask you to send money through Google Chat, or any private data such as account logins, bank info, or your Social Security number. That’s just not how businesses and governments operate. They can’t assume that you have access to Chat, after all.
• If something seems too good to be true, it probably is. Stay skeptical. You’re probably not going to luck into a fortune or the love of your life through random messaging encounters.