Passkeys instead of passwords: Is the world ready?

Passkeys are gradually emerging as the new standard for digital authentication, with the potential to replace traditional passwords altogether. The world’s largest technology companies have already embraced this approach, while cybersecurity experts describe it as one of the most significant advances in digital security in recent decades. Why is this technology considered so transformative, what problems does it solve, and is the world ready to abandon passwords entirely? We take a closer look.

TABLE OF CONTENTS:

A Long-Overdue End

The password is one of the oldest – and most vulnerable – concepts in digital security, having outlived its practical usefulness by decades. In 1961, the Massachusetts Institute of Technology introduced passwords to control access to its Compatible Time-Sharing System (CTSS), and the underlying authentication model has remained largely unchanged ever since. A user creates a secret string of characters, memorizes or stores it somewhere, submits it to a server, and the server determines whether the user is authorized.

More than six decades of relying on this approach have exposed its fundamental weaknesses. According to the 2024 Verizon Data Breach Investigations Report, over 80% of confirmed security breaches involve compromised credentials, including weak, reused, or phishing-stolen passwords.

The industry responded to these shortcomings with incremental fixes, including password managers, SMS-based two-factor authentication, and authenticator apps. However, all of these solutions remained layers built on top of a fundamentally flawed authentication model. The emergence of passkeys marked the first genuine architectural shift, and by 2026 the technology is no longer a niche experiment. The remaining question is whether the broader ecosystem can keep pace: billions of users, hundreds of thousands of online services, and countless regulatory frameworks, each with its own degree of inertia.

What Is a Passkey, and Why Is It More Than Just a “New Password”?

To understand the significance of this shift, it is important to examine the underlying architecture. A passkey is an implementation of the WebAuthn standard, developed by the FIDO (Fast Identity Online) Alliance in collaboration with the World Wide Web Consortium (W3C). Unlike a password, which is a shared secret stored both on the user’s device and on the server, a passkey is based on public-key cryptography.

The process works as follows: when a user registers with a service, their device generates a cryptographic key pair consisting of a public key and a private key. The public key is transmitted to the server and stored there, while the private key never leaves the user’s device. Instead, it is protected by a hardware security module such as a Trusted Platform Module (TPM), Apple’s Secure Enclave, or an equivalent secure element. During authentication, the server issues a cryptographic challenge, which the device signs using the private key. The server then verifies the signature with the corresponding public key before granting access. In this model, phishing attacks become largely ineffective. Even if an attacker intercepts network traffic or tricks a user into visiting a fraudulent website, there is no reusable secret or private key to steal. Moreover, the server itself stores no credential that would be valuable to an attacker in the event of a breach.

Equally important is the human factor. Passkeys were designed from the outset to align with the way people naturally interact with their devices. Authentication relies on mechanisms that are already built into modern hardware, including fingerprint recognition, Face ID, the device PIN, or a hardware security key. Users no longer need to memorize passwords, invent complex character strings, or enter credentials manually. Rather than weakening security for the sake of convenience, passkeys integrate strong cryptographic protection with a frictionless user experience – two objectives that were long considered difficult to achieve simultaneously.

Market Consensus and an Unprecedented Technology Coalition

The speed with which the world’s largest technology companies converged on a single authentication standard is unprecedented in an industry traditionally characterized by competing ecosystems. Apple introduced passkey support with iOS 16 and macOS Ventura in late 2022, Google rolled out the technology across Chrome and Android during the same period, and Microsoft integrated support into Windows 11 and Azure Active Directory. All three aligned around the FIDO2/WebAuthn standard not by coincidence, but because the password-based authentication model had become a systemic risk to the broader digital economy.

By 2025, passkeys were supported across more than 13 billion user accounts worldwide. Companies including Amazon, PayPal, GitHub, Shopify, Adobe, Uber, WhatsApp, Coinbase, and 1Password had adopted the technology, spanning sectors such as financial services, e-commerce, software development, and social media. According to FIDO Alliance Passkey Central, the number of websites supporting WebAuthn grew from only a few thousand in 2022 to several hundred thousand by 2025, with adoption continuing to accelerate.

Google’s approach is particularly illustrative. Rather than simply offering passkeys as an optional authentication method, the company made them the default sign-in option for new Google accounts in 2024. This was more than a product decision or a marketing initiative – it represented an architectural shift with implications for billions of users. When a platform operating at Google’s scale changes the default, it effectively redefines the baseline for the entire industry.

Synchronization and Multi-Device Support: A Solved Problem or a New Vulnerability?

One of the strongest early criticisms of passkeys concerned availability. If a credential is tied to a single device, what happens when that device is lost, stolen, or replaced? The ecosystem addressed this challenge through synchronized passkeys stored in cloud-based credential managers, such as Apple’s iCloud Keychain, Google Password Manager, 1Password, and Bitwarden. While this approach largely resolved the usability issue, it also introduced a broader technical and philosophical debate over a new threat model.

A synchronized passkey is stored in encrypted form in the cloud and made available across all devices within the user’s ecosystem. In theory, this means that compromising an Apple ID or Google Account could provide access to the synchronized credentials. Critics argue that this simply replaces password-related vulnerabilities with dependence on the security of a centralized identity provider. Proponents counter that major cloud platforms protect these credential stores far more rigorously than most online services protect password databases, and that strong account security – particularly multi-factor authentication – reduces the associated risk to a very low level.

For environments requiring the highest level of security – such as financial institutions, government services, and enterprise infrastructure – the preferred solution is hardware-bound passkeys stored on dedicated security devices such as YubiKey or Google Titan Security Keys. These credentials are neither synchronized nor exported from the hardware, requiring physical possession of the security key for authentication. Although this represents a specialized segment of the market, it plays a critical role in high-assurance security. Google, for example, introduced mandatory hardware security keys for all employees in 2017 and has since reported no successful phishing attacks resulting in the compromise of employee accounts.

User Experience as the Battleground: What Users Actually Experience

A technology can be technically superior, but if the user experience is frustrating, widespread adoption is unlikely. This is where passkeys present their most nuanced picture.

In scenarios where the technology functions as intended, the experience is genuinely transformative. A user visits a website, selects “Sign in,” authenticates with Face ID or Touch ID in a fraction of a second, and gains immediate access. There are no passwords to type, no “Forgot password?” prompts, and no waiting for SMS verification codes. For users accustomed to modern iPhones or Android devices, the process feels intuitive, seamless, and significantly faster than conventional authentication methods.

However, the reality in 2026 is considerably more complex. Cross-platform interoperability remains one of the technology’s greatest challenges. A passkey created in Safari on an iPhone, for example, does not always provide a seamless sign-in experience when used with Chrome on a Windows PC. In principle, this can be addressed through QR code authentication or Bluetooth-based device verification. In practice, however, these workflows remain unfamiliar to many users. A 2025 study by the Nielsen Norman Group found that 34% of participants were unable to complete a cross-platform passkey sign-in without assistance.

Account recovery presents an even greater challenge. The password era addressed this problem with a simple – if imperfect – approach: enter an email address and receive a password reset link. Passkeys require more sophisticated recovery mechanisms, including backup codes, trusted devices, or identity verification through the account provider. The industry has yet to converge on a consistent recovery model, leaving each service to implement its own approach. While this may be manageable for technically proficient users, it can become a significant obstacle for less experienced users, particularly those setting up a smartphone for the first time.

The Enterprise Sector: Balancing Security and Legacy Infrastructure

If the consumer market has been slow to adopt passkeys, enterprise adoption – particularly among small and medium-sized businesses – has progressed even more gradually. The primary obstacle is not resistance to the technology itself, but the complexity of existing IT infrastructure.

Many organizations continue to rely heavily on VPN-based access, Active Directory, and LDAP authentication systems, technologies that originated in the 1990s and early 2000s. While passkeys can be integrated into these environments through FIDO2-compatible identity providers (IdPs) such as Okta, Microsoft Entra ID, or Ping Identity, doing so typically requires a substantial architectural redesign, system migration, and user retraining. These are complex, resource-intensive initiatives that often take years to complete.

According to the analyst firm KuppingerCole, by 2025 only around 22% of large enterprises in North America and Western Europe had deployed passkeys as either the primary or a hybrid authentication method for corporate applications. Most organizations were still in the pilot phase or continued to rely on traditional multi-factor authentication (MFA) solutions. Adoption was lowest in healthcare and the public sector, where regulatory requirements and procurement cycles tend to be particularly conservative.

At the same time, early enterprise deployments have produced notable results. DocuSign reported a 60% reduction in authentication time after introducing passkeys for its internal systems. Shopify recorded a 40% decline in password-related support requests following the rollout of passkeys for store administrators. These figures represent more than marketing claims – they demonstrate measurable operational improvements that are difficult for organizations, particularly financial decision-makers, to overlook.

The Regulatory Landscape: From Recommendations to Requirements

Authentication standards have evolved beyond a purely technical issue and are now an important focus of regulatory policy. The EU’s NIS2 Directive, which became fully applicable in 2024, requires operators of critical infrastructure to implement robust multi-factor authentication for all administrative access. While the directive does not mandate specific technologies, FIDO2-based authentication and passkeys have emerged as the de facto preferred approach for meeting these requirements.

In the United States, the National Institute of Standards and Technology (NIST) updated its Digital Identity Guidelines (SP 800-63 series) in 2024, placing significantly greater emphasis on phishing-resistant multi-factor authentication – a category that passkeys satisfy by design. U.S. federal agencies are required to comply with these updated guidelines, further accelerating the adoption of FIDO2-based authentication across government systems.

Data protection has also emerged as a key regulatory consideration. The EU’s General Data Protection Regulation (GDPR) and similar privacy frameworks in other jurisdictions raise important questions about where and how synchronized passkeys are stored. If encrypted credentials are synchronized through the cloud infrastructure of a U.S.-based provider, for example, does this comply with European data localization and privacy requirements? The issue remains unresolved and has already become the subject of ongoing discussions between the FIDO Alliance and European regulators.

The Geopolitical Dimension: Trust, Digital Ecosystems, and Identity Sovereignty

Behind the technical discussions surrounding convenience and security lies a broader question that is rarely addressed explicitly but is increasingly important for governments and large organizations: who should be trusted to manage digital identity?

Synchronized passkeys within the Apple and Google ecosystems rely on the infrastructure of two U.S.-based technology companies to facilitate credential synchronization. For jurisdictions pursuing greater digital sovereignty – including the European Union through the eIDAS 2.0 framework and the European Digital Identity Wallet, India with Aadhaar, and China with its own parallel digital identity ecosystem – this is a matter of strategic importance. While passkeys themselves are based on an open, vendor-neutral standard, their implementation through the cloud services of major platform providers inevitably creates a degree of dependence on those providers’ infrastructure, service policies, and, potentially, their relationships with national regulators.

The European Union is addressing this challenge through the European Digital Identity Wallet, an initiative designed to provide citizens with a digital identity framework that operates independently of major commercial platforms. The ISO/IEC 18013-5 standard, which underpins the EU’s digital identity credentials, is technically compatible with FIDO2. However, it envisions cryptographic keys being stored by certified national authorities or European Trust Services rather than in cloud ecosystems such as iCloud or Google Account. Although this architecture is more complex and requires substantial public investment, it reflects a broader strategic objective of maintaining sovereign control over digital identity.

For Ukraine, which continues to develop resilient digital infrastructure amid an ongoing war and persistent cyber threats from Russia, authentication has become an issue of particular strategic importance. Government services delivered through Diia already rely on strong authentication mechanisms, including BankID and mobile digital signatures. However, adopting FIDO2-compatible passkeys for public services could significantly reduce the overall attack surface, particularly given that phishing and credential compromise remain among the most common attack vectors targeting the country’s civilian digital infrastructure.

The Digital Divide: Who Gets Left Behind?

No technological revolution is socially neutral, and the transition to passkeys is no exception. Behind the move toward passwordless authentication lie several forms of digital inequality that, so far, have been discussed primarily in academic and policy circles.

The first concerns device compatibility. Passkeys require relatively modern hardware equipped with security technologies such as a Trusted Platform Module (TPM), Apple’s Secure Enclave, or an equivalent secure element, as well as an operating system that supports the FIDO2 standard. Billions of people in developing economies continue to rely on low-cost Android devices running outdated operating systems or older computers that lack the necessary hardware. For these users, passkeys remain inaccessible without upgrading their devices – an economic barrier that is far from trivial.

The second dimension is cognitive. Older adults and users with limited digital literacy often already find passwords and multi-factor authentication difficult to navigate. Moving away from the familiar mental model of “enter your secret password” toward a more abstract concept – where a trusted device cryptographically proves a user’s identity – requires both user education and carefully designed interfaces. Without meaningful investment in onboarding and usability, service providers risk creating additional barriers for a significant portion of their user base.

The third dimension is situational. Consider users with limited or unstable access to personal devices, such as refugees who have lost both their phone and laptop, or individuals who rely on shared computers in libraries or other public spaces. Recovery and fallback mechanisms for passkeys have not yet matured to the point where these scenarios are consistently addressed. Ironically, those who stand to benefit most from stronger security are often the least well served by authentication systems designed around the assumptions of a typical user with a modern smartphone and continuous access to personal devices.

The Competitive Landscape: Password Managers and the Question of Survival

The rise of passkeys has unexpectedly challenged an entire category of software: password managers. Companies such as 1Password, Dashlane, Bitwarden, LastPass, and Keeper built their businesses around helping users create, store, and manage passwords. For some, including 1Password, this evolved into a multibillion-dollar business.

The industry’s response has been notably pragmatic. Rather than resisting the transition, leading password manager providers have positioned themselves as part of the emerging ecosystem. Both 1Password and Bitwarden now support passkeys, offering cross-platform credential management that reduces dependence on a single ecosystem such as Apple’s or Google’s. In effect, they are shifting from password management to broader identity management, enabling users to store and synchronize passkeys regardless of their device manufacturer.

This strategy, however, faces growing competition from the platform vendors themselves. Apple and Google both provide built-in credential managers that are deeply integrated into their operating systems and available at no additional cost. For many consumers – particularly those who remain within a single ecosystem – dedicated password management software may become increasingly unnecessary. As a result, the consumer password manager market is likely to undergo further consolidation, while the enterprise segment, with its requirements for auditing, centralized administration, compliance, and cross-platform interoperability, is expected to remain considerably more resilient.

A Transitional Period: Hybrid Authentication for Years to Come

It would be unrealistic to expect passwords to disappear within the next year or two. The scale of the challenge is enormous. By some estimates, there are between 300 and 500 billion active username-password combinations in use across online services worldwide. Even under the most optimistic assumptions, migrating an ecosystem of this size cannot happen overnight.

A more realistic outlook for the next five to seven years is a hybrid authentication landscape. Passkeys are likely to become the preferred option for new users and newly developed services, while passwords – often combined with traditional multi-factor authentication (MFA) – will continue to support legacy accounts, older devices, and specialized use cases. As a result, security teams and UX designers will need to maintain both authentication flows in parallel for the foreseeable future, increasing product complexity and expanding the potential surface for implementation errors.

There is, however, a more accelerated scenario. Rather than being driven by gradual market adoption, widespread migration could be triggered by a major cybersecurity incident. A large-scale breach affecting hundreds of millions of accounts through conventional phishing techniques could significantly increase regulatory pressure and encourage organizations to mandate phishing-resistant authentication. The technology industry has repeatedly shown that its most consequential transformations are often driven not by long-term vision alone, but by the urgency created by major security failures.

The Technology Is Ready – Now the Rest Must Catch Up

Passkeys are not simply another marketing rebrand in cybersecurity. They represent a technically mature, standardized, and cryptographically robust authentication model that addresses a fundamental weakness the industry has attempted to mitigate with incremental fixes for more than six decades. The standard is open, backed by the world’s leading technology companies, and has already demonstrated measurable security and usability benefits wherever it has been deployed at scale.

Technology alone, however, is only a necessary condition – not a sufficient one. The success of passkeys will ultimately depend on whether UX teams can design onboarding experiences that are intuitive for users beyond the technology community; whether service providers can establish reliable account recovery mechanisms; whether enterprises can commit the resources required to modernize legacy infrastructure; whether regulators can develop clear governance frameworks for synchronized credentials in the context of data sovereignty; and whether the needs of users without access to modern devices are adequately addressed.

The password era is coming to an end – but gradually, unevenly, and not without resistance. Passkeys are no longer a question of technical feasibility; they are a question of adoption. Their widespread success will not be determined by cryptography alone, but by the degree of trust, usability, and institutional readiness that develops around them. That is where the real transition is taking place.

Read also:

Passkeys Instead of Passwords: Is the World Ready for a New Authentication System?