The FIDO Alliance said this month that an estimated seven billion passkeys are now in use worldwide, up from five billion in May. Its 2026 Passkey Index found that passkeys accounted for 36% of successful sign-ins across participating services, compared with 26% a year earlier.
The index draws on data from 15 major consumer services, including Amazon, Google, Microsoft, PayPal, TikTok and WhatsApp. It measures activity among participating platforms rather than every online account, making its findings evidence of substantial progress rather than proof that passwords are approaching universal extinction.
Across the participating services, an average 90% of active accounts were eligible to use passkeys, while 38% of all active accounts had one configured. Passkey authentication succeeded in 93% of attempts, compared with 78% for passwords combined with traditional multifactor authentication. Passkey sign-ins were also 2.8 times faster, saving approximately 27 seconds per attempt.
Separate research published by password manager Dashlane on 13 October found that monthly passkey authentications among its users had almost doubled over 12 months, reaching 2.5 million. The proportion of its users holding at least one passkey increased to 57%, from 40% in 2025 and 20% in 2024.
Dashlane said that, if this trajectory continues, roughly four in five of its users could have at least one passkey by mid-2027. That projection concerns adoption within its own customer base, not the abolition of passwords across the internet. Even at the domain with its highest measured passkey penetration, approximately seven in ten authentications still used other methods.
A further study from security companies Yubico and Okta, released on 7 October, exposed a persistent gap between awareness and behaviour. Their survey of nearly 2,000 cybersecurity and technology professionals across nine countries found that 87% knew about passkeys, yet 43% continued using passwords for workplace access.
More than half of respondents had received usernames and passwords when joining their organisations, while 76% worked in environments using fragmented authentication methods across internal applications. The findings suggest that existing systems and onboarding practices, rather than unfamiliarity alone, are delaying change.
The FIDO Alliance’s broader consumer research, published in May, found that 75% of respondents had enabled passkeys on at least one account, although only 49% used them regularly when available. Its workforce survey found 68% of organisations were deploying, piloting or rolling out passkeys, while 57% still depended on authentication methods vulnerable to phishing for everyday employee access.
Passkeys replace memorised secrets with cryptographic credentials linked to a website or application. A private key remains protected on a user’s device or within a credential provider, while the service verifies authentication using a corresponding public key. Users commonly unlock access through a fingerprint, facial recognition or device PIN.
Because passkeys are tied to legitimate services, fraudulent websites cannot simply capture and reuse them as they can passwords. Their design also reduces exposure to credential-stuffing attacks, in which criminals test stolen password combinations across multiple accounts.
Nevertheless, the transition raises practical difficulties. Users can encounter problems when switching devices, sharing accounts or recovering access after losing a phone. Organisations must also consider older applications, shared workstations and people unable or unwilling to use particular authentication technologies.
An academic field study presented at the 2026 IEEE Symposium on Security and Privacy tracked 2,716 participants over six months. Researchers found improving passkey acceptance and authentication success, but identified obstacles involving cross-platform synchronisation, credential sharing and password-manager interactions.
The security implications extend beyond convenience. Yubico and Okta found that 44% of organisations surveyed had experienced an AI-driven attack during the preceding year, strengthening the case for authentication that does not rely on recognising suspicious messages. However, replacing a password at login does not automatically secure account recovery, customer support or administrative access. Attackers may target those processes instead, making identity checks and recovery safeguards important alongside stronger credentials for businesses and consumers alike.
Microsoft has separately announced that security questions will cease to be available as a password-reset option in its Entra ID identity platform from January 2027. The company cited the susceptibility of such questions to guessing and social engineering, illustrating how providers are withdrawing weaker recovery methods even while passwords remain supported elsewhere.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
