Edition of News, explained
eclair.world Search
eclair.world

Edition of Thursday 12 November 2026

Technology

Passkeys explained: how they replace passwords and how widely they are used

A passkey is a sign-in credential made of two cryptographic keys, one kept on your device and one held by the website, so there is no password to steal or type. As of October 2026, the FIDO Alliance estimates 7 billion passkeys are in use.

By , Editor-in-chief

· 6 min read

An unbranded smartphone and an old brass key side by side on a wooden desk
An unbranded smartphone and an old brass key side by side on a wooden desk Illustration generated with AI.

A passkey is a way to sign in to a website or app without a password. Instead of a secret you type, your device holds a private cryptographic key and unlocks it with your fingerprint, face or PIN. The website keeps only a matching public key, which is useless to a thief. By October 2026 passkeys had moved from a niche option to a routine sign-in method at many large services.

How does a passkey actually work?

A passkey works by public-key cryptography: your device signs a challenge with a private key, and the website checks the signature with a public key it stored when you registered. According to Google's developer documentation, creating a passkey generates a public–private key pair on the user's device, and developers save only the public key on their servers. An attacker cannot work out the private key from what the server stores.

You never see the keys. When you sign in, the phone or computer asks you to unlock it in the usual way. The FIDO Alliance, the industry body behind the standard, notes that biometric data stays on the device; the website receives only confirmation that the check succeeded.

  1. You choose to create a passkey on a site's security settings page.
  2. Your device makes two linked keys and sends the public one to the site.
  3. At the next sign-in, the site sends a random challenge.
  4. You unlock your device with a fingerprint, face scan or PIN, and it signs the challenge with the private key.
  5. The site verifies the signature with the public key and lets you in.

Why are passkeys harder to phish than passwords?

Passkeys resist phishing because the browser and operating system will only use a passkey on the website that created it. A fake site with a look-alike address simply cannot ask for the right key. Google describes this domain binding as the reason passkeys are resistant to phishing attacks.

There is also nothing reusable to leak. Because the server holds only public keys, a breach of its database does not expose secrets that work elsewhere. In April 2026 the UK's National Cyber Security Centre said it would recommend passkeys wherever a service supports them, and two-step verification where it does not. The FIDO Alliance summary of that guidance notes the NCSC's view that codes sent by SMS or email, app codes and push approvals are all open to phishing.

How many people use passkeys in 2026?

Passkeys are now widely used: the FIDO Alliance estimated in October 2026 that 7 billion are in use worldwide, up from its May 2026 estimate of 5 billion. Its Passkey Index 2026, built from data supplied by 15 consumer services including Amazon, Google, Microsoft, PayPal, TikTok and WhatsApp, gives a more detailed picture.

Passkey use across participating services. Source: FIDO Alliance Passkey Index, October 2026 (unweighted averages; 2025 had 9 participants, 2026 had 15, so comparisons are directional).
Measure20252026
Share of all accounts with a passkey34%38%
Share of successful sign-ins using a passkey26%36%
Active accounts eligible for passkeys93%90%
Sign-in success rate, passkeys vs passwords and traditional MFAn/a93% vs 78%

The same index reports that passkey sign-ins were 2.8 times faster than signing in without one, saving an average of 27 seconds each time. All eight participants that measure phishing reported fewer successful attacks after deploying passkeys. Consumer awareness is high too: in a survey of 11,000 adults in ten countries published in May 2026, 90% said they were familiar with passkeys and 75% said they had enabled them on at least some accounts.

What happens if I lose my phone?

Losing a phone does not usually mean losing your passkeys, because most are synced through a passkey provider's account. The FIDO Alliance explains that passkeys can be synced across a user's devices, with end-to-end encryption, or bound to one device such as a hardware security key. A synced passkey reappears on a new device once you sign in to the same provider account.

Device-bound passkeys are different: if the key is lost, you need another sign-in method or the service's account recovery process. That is why many services still let you keep a backup method, and why it is sensible to register more than one device where possible.

Are passwords going away?

Passwords are being pushed into the background rather than removed overnight. In May 2025 Microsoft made new consumer accounts passwordless by default, while existing users can choose to delete their password. In the 2026 Passkey Index, 9 of 13 services that answered said they plan to offer fully passwordless accounts within 12 months.

The main obstacle is habit and design, not technology. The index found that 8 of 10 services still had a lower passkey sign-in share than enrolment rate, partly because some sign-in pages offer a password or one-time code first. Sign-in is also becoming a question for software that acts on your behalf; our explainer on AI agents in everyday software looks at how those tools log in to sites. Regulation of the wider digital landscape is covered in our EU AI Act timeline.

Frequently asked questions

Is a passkey the same as two-factor authentication?

Not exactly, but it can do the same job. A passkey combines something you have, your device, with something you are or know, your fingerprint, face or PIN. The UK's NCSC says that when user verification is required, these FIDO2 credentials count as multi-factor authentication, and that they are as secure as or more secure than traditional methods such as SMS codes.

Does the website get my fingerprint or face scan?

No. The biometric check happens on your own device and never leaves it. According to the FIDO Alliance, the website receives only confirmation that the check succeeded, together with a cryptographic signature. The service stores a public key, not any biometric data, so a breach of the service cannot expose your fingerprint.

Are passkeys faster than passwords?

Yes, on average. The FIDO Alliance Passkey Index 2026 found passkey sign-ins were 2.8 times faster than signing in without one, saving about 27 seconds per sign-in across the nine services that measured speed. Passkey sign-ins also succeeded 93% of the time, against 78% for passwords combined with traditional multi-factor methods.

Which services support passkeys?

Many large consumer services now do. The 15 participants in the FIDO Alliance's 2026 Passkey Index include Amazon, Google, Microsoft, PayPal, Shopify, TikTok, WhatsApp, CVS and JPMorgan Chase. Most let you add a passkey from the security or sign-in section of your account settings.

Should I still keep my password?

Keep a recovery method until you are confident your passkeys are synced or registered on more than one device. Where a service allows a passwordless account, removing the password closes the route attackers use most. Microsoft, for example, lets existing users delete their password in account settings once a passwordless method is set up.

Sources