Google's browser-based method uses a new key each time, set to expire from the server-side authorized_keys file in a short time (minutes). I strongly suspect, b

Google's browser-based method uses a new key each time, set to expire from the server-side authorized_keys file in a short time (minutes). I strongly suspect, but haven't checked, that this is also true for their Cloud Console mobile app's SSH feature. You're mostly right about gcloud, with some nuances for multi-user or network-homedir environments among other exceptions. Gcloud does however have one of the snazziest possible hacks for resetting and securely communicating Windows account passwords: https://cloud.google.com/compute/docs/instances/windows/automate-pw-generation https://cloud.google.com/compute/docs/instances/windows/auto...