There are now five billion passkeys in use worldwide, and 90% of people say they know what one is. Passkeys are a genuine improvement on passwords — not marketing, a real change in how logging in works.
Here is the part that rarely makes the coverage. A passkey protects your front door. It does nothing about the back door — the "forgot my login" path — and on most accounts that back door is still a text message or an email link. When a phishing-resistant passkey sits in front of a recovery flow that a scammer can defeat, your account's real security is set by the weaker of the two.
So this guide covers both halves: what passkeys genuinely fix, exactly how they do it, and the three gaps you need to close yourself before the protection is real.
What a Passkey Actually Is
A password is a shared secret. You know it, the website stores a version of it, and anything you both know can be stolen, guessed, reused, or handed to the wrong person.
A passkey replaces that with a key pair. When you create one, your device generates two mathematically linked keys:
- The public key goes to the website. It can verify a signature but cannot produce one, so it is close to useless to a thief.
- The private key stays on your device. Per the W3C WebAuthn specification, it "is expected to never be exposed to any other party."
Logging in works by challenge and response. The site sends a random challenge, your device signs it with the private key after you approve with a fingerprint, face, or PIN, and the site checks the signature against the public key it already holds.
Nothing reusable ever crosses the network. There is no secret sitting in the site's database for a breach to spill, and nothing for you to accidentally type into the wrong box.
Why That Actually Blocks Phishing
"No password to steal" is the explanation you usually get, and it is incomplete. The mechanism that defeats phishing is more specific, and more interesting.
Every passkey is scoped to the site that created it. The WebAuthn spec ties each credential to a Relying Party ID — effectively the site's domain — and states that this scoping is "enforced jointly by conforming User Agents and authenticators." In plain terms: your browser checks the domain, and if it does not match, it will not even offer the passkey.
That changes what a phishing attack can achieve. On a convincing fake login page, a password gets typed in and captured. A passkey is never offered, because the browser sees a different domain and stays silent. You cannot be talked into handing it over, because you are not the one performing the check.
This is why the standard carries unusual weight with government agencies. CISA states that "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication," and that when someone is tricked into logging into a fake website, "the FIDO protocol will block the attempt." Authenticator codes and SMS codes do not clear that bar, because a person can always be persuaded to read a code aloud.
What Passkeys Genuinely Fix
| Attack | Does a passkey stop it? | Why |
|---|---|---|
| Phishing a login page | Yes | Credential is scoped to the real domain and never offered elsewhere |
| Password reuse across sites | Yes | Every passkey is unique and site-specific by construction |
| Credential stuffing | Yes | There is no password to replay from another breach |
| Server-side breach leaking passwords | Yes | The site only ever holds a public key |
| Brute force and guessing | Yes | Nothing guessable is involved |
| Keyloggers capturing what you type | Yes | You never type the credential |
| Malware already on your device | No | It may be able to abuse an unlocked device directly |
| Attacks on your account recovery flow | No | Recovery is a separate system, and usually the weaker one |
| Someone with your unlocked phone | Partly | Depends on whether biometric or PIN confirmation is required |
Read the top of that table and passkeys look close to a solved problem for the most common attacks people actually face. That is a fair reading, and it is why the technology is worth adopting.
Now read the bottom three rows, because that is the rest of the story.
The Catch: Your Recovery Path Is Your Real Security
A passkey secures the way you normally log in. It says nothing about what happens when you can't.
Almost every account keeps a recovery route for a lost device or a forgotten login, and on most consumer services that route is still a code by SMS, a link by email, or a security question. Those are the mechanisms an attacker will target — because why fight the strong door when the weak one is unlocked?
This is not a fringe worry. NIST classifies SMS and voice delivery as a restricted authenticator in SP 800-63B, meaning it "should not be used for new implementations" and may be removed from future editions of the guidance entirely. The reasons are concrete: attackers can get a phone number reassigned to a device they control, weaknesses in the SS7 telephone signalling system allow messages to be intercepted, and messages can often be forwarded to another device. NIST is also explicit that out-of-band authentication is not phishing-resistant.
So the shape of the problem is this: you can protect the front door with the one method CISA calls phishing-resistant, and leave the back door fitted with a method NIST says should not be used for new systems.
Microsoft's own identity engineering team makes the same point in a post titled "Passkeys aren't the finish line: Eliminating fallbacks and fixing recovery". When the companies building this technology say the job is half done, that is worth taking at face value.
What to actually do: on your most important accounts, go into security settings and look at recovery, not just login. Remove SMS as a recovery method where the service lets you. Replace it with recovery codes you print and store physically, or a second passkey on a different device. If a service forces SMS recovery and holds something valuable, that is a genuine reason to weigh moving.
The Password That Is Usually Still There
There is a second gap, and it is the more common one.
Adding a passkey rarely removes the password. Most services register the passkey as an additional way in and leave the old credential active — so the phishable path still exists, and an attacker can simply choose it.
The industry numbers show how widespread this is. In the FIDO Alliance's 2026 World Passkey Day report, 82% of organisations name fully passwordless authentication as their ultimate goal — and only 28% have got there. Among those that have not, 24% say they are waiting for standards to mature and 16% believe passwords plus MFA are already sufficient.
Until the password is actually gone, a passkey is a strong lock fitted alongside a weaker one on the same door. It still helps: it removes your daily exposure to phishing, and it is the path you will use hundreds of times a year. But it is protection in addition to a weakness, not instead of it.
Where a service offers it, look for a setting along the lines of "remove password" or "passkey-only sign-in." That single toggle converts a partial improvement into a real one.
Device Loss, Sync, and Being Locked In
The most common practical worry is the most easily answered: what if you lose the phone?
Most consumer passkeys today are synced passkeys. They are backed up through your platform account — Apple, Google, or Microsoft — and appear automatically on your other devices. Lose one device and your passkeys are still on the others, and still recoverable onto a replacement.
That convenience has a trade-off worth understanding. Your passkeys now live inside a platform ecosystem, and moving between them is not always smooth. Cross-platform transfer has improved but remains one of the rough edges of the rollout.
The alternative is a device-bound passkey, which never leaves the hardware it was created on — the model used by the physical security keys in the photo at the top of this article. Nothing to sync means nothing to intercept in transit, at the cost of no automatic backup. Lose the key without a spare and you are relying on recovery codes.
For most people the sensible arrangement is straightforward: use synced passkeys for everyday accounts, and for your two or three most valuable accounts, register two passkeys on separate devices plus printed recovery codes. Redundancy is what removes the fear of lock-out, and lock-out fear is the main reason people keep the weak fallback switched on.
Where the Rollout Actually Is
Adoption is real but uneven, and the gaps between the figures tell you more than the headline.
| Measure | 2026 figure |
|---|---|
| Passkeys in use worldwide | 5 billion |
| Consumers aware of passkeys | 90% |
| Have enabled one on at least one account | 75% |
| Use them regularly when available | 49% |
| Organisations deployed or actively deploying | 68% |
| Organisations naming fully passwordless as the goal | 82% |
| Organisations that have actually achieved it | 28% |
The 90%-aware against 49%-regularly-using gap is the consumer version of the same thing. People know about passkeys, have often switched one account on, and then carry on using passwords everywhere else out of habit or patchy support.
One more figure from the same report puts the effort in perspective: one in three people (33%) experienced an account compromise or received a breach notification in the past year. The problem passkeys address is not hypothetical — and if you have had one of those notices, the order you respond in matters more than the individual steps, which we cover in what to do after a breach notification.
Should You Switch?
Yes — with the recovery caveat handled. A practical order of operations:
- Start with your email account. It is the master key: whoever controls it can reset most of your other accounts. Add a passkey there first.
- Then anything holding money or identity. Banking, payment services, government portals, and your password manager itself.
- Fix recovery on those accounts before moving on. Remove SMS recovery where possible, save recovery codes offline, register a second passkey.
- Remove the password where the service allows it. This is the step that turns the improvement into real protection.
- Keep a password manager. Plenty of sites still have no passkey support, and unique strong passwords remain the right answer there. If you are unsure whether concentrating passwords in one vault is wise, how password managers actually work explains why a provider breach usually cannot expose them.
Passkeys reduce the damage a stolen or leaked credential can do, which also reduces the fallout from the kind of account takeover that ends in fraudulent accounts opened in your name — worth checking your credit report periodically for regardless of how you log in.
Common Misconceptions
"A passkey is just a password stored on my phone." No. A password is a secret both parties know. A passkey is a private key that never leaves your device and is never transmitted — the site only ever sees a signature it can verify.
"My biometrics get sent to the website." They do not. The fingerprint or face scan unlocks the private key locally on your device. Biometric data stays on the hardware; the site receives only the signed challenge.
"If someone steals my phone they have all my accounts." Using a passkey requires the device to be unlocked and typically a fresh biometric or PIN confirmation. A stolen locked phone is not an open door — though this is a good reason to use a strong device passcode.
"Passkeys replace my authenticator app, so the difference does not matter." It matters a great deal while you still use codes elsewhere — see how the methods compare in SMS vs app vs passkey.
"Passkeys mean I no longer need a password manager." Not yet. Support is broad but far from universal, so you will keep passwords on many sites for years. Most password managers now store passkeys too.
"Passkeys make my account unphishable." Only the login step, and only if the password and phishable recovery routes are actually removed. Otherwise the attacker just uses the path you left open.
The Bottom Line
Passkeys are the first login technology in decades that removes a whole class of attack rather than making the user try harder. The mechanism is sound: nothing reusable is transmitted, and the browser refuses to release the credential to the wrong domain — which is why CISA treats FIDO/WebAuthn as the only widely available phishing-resistant option.
But the protection is only as good as the weakest way into the account. Adding a passkey while leaving an active password and SMS recovery in place gets you a strong front door in a building with the back door propped open. The work that finishes the job is unglamorous: remove the password where you can, get SMS out of your recovery settings, store offline recovery codes, and register a second passkey on your most important accounts.
Do those four things and passkeys deliver what they promise. Skip them and you have improved your daily experience more than your actual security. More in our cybersecurity hub, and for the longer-term threat to the cryptography all of this rests on, see will quantum computers break encryption.
Frequently Asked Questions
What is a passkey in simple terms?
It is a pair of cryptographic keys that replaces a password. Your device keeps the private key and never shares it; the website keeps the matching public key. To log in, the site sends a random challenge, your device signs it after you approve with a fingerprint, face or PIN, and the site verifies the signature. Nothing reusable is ever transmitted, so there is no secret for a breach to leak or a scammer to capture.
Are passkeys really more secure than passwords?
For the attacks most people face, substantially. They cannot be phished at the login step, cannot be reused across sites, cannot be brute-forced, and cannot be leaked by a server breach because the site only stores a public key. CISA describes FIDO/WebAuthn as the only widely available phishing-resistant authentication. The gaps are account recovery, any password left active alongside the passkey, and malware already running on your device.
What happens if I lose the device with my passkey?
Usually nothing dramatic. Most consumer passkeys are synced through your Apple, Google or Microsoft account, so they are already on your other devices and restore onto a replacement. The risk is a passkey that exists on only one device with no backup. For important accounts, register a passkey on a second device and keep printed recovery codes, which also lets you remove weaker fallbacks like SMS.
Do passkeys replace two-factor authentication?
A passkey is generally treated as both factors at once — something you have (the device holding the private key) and something you are or know (the biometric or PIN that unlocks it). So a passkey typically replaces the password plus the second-factor code. Whether that is enough depends on the service; some high-value accounts still layer additional checks on top.
Why is SMS recovery a problem if my login uses a passkey?
Because recovery is a separate way into the same account, and an attacker will pick whichever is weaker. NIST classifies SMS and voice delivery as a restricted authenticator that should not be used for new implementations, citing phone-number reassignment, SS7 interception and message forwarding. A phishing-resistant passkey in front of an SMS recovery path means your effective security is the SMS path.
Should I delete my passwords once I add a passkey?
Remove the password where the service supports passkey-only sign-in — that is the step that closes the phishable route and turns a partial improvement into a real one. Where a service does not support it, keep a unique strong password in a password manager. Adoption is still uneven: 82% of organisations say full passwordless is the goal, but only 28% have got there.
Sources
- FIDO Alliance Reports Accelerating Global Passkey Adoption on World Passkey Day 2026 — FIDO Alliance
- Web Authentication: An API for accessing Public Key Credentials, Level 3 — W3C
- Next Level MFA: FIDO Authentication — Cybersecurity and Infrastructure Security Agency (CISA)
- More than a Password: the MFA strength hierarchy — CISA
- NIST SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management — National Institute of Standards and Technology
- Passkeys aren't the finish line: Eliminating fallbacks and fixing recovery — Microsoft Entra engineering blog
