Passwords Are Dying, But Slowly: What Passkeys Actually Are and Whether to Trust Them in 2026

You've probably seen the prompt by now. You go to log into Gmail, Amazon, or PayPal, and instead of asking for a password, the site asks if you'd like to use your face, your fingerprint, or your phone's PIN instead. That's a passkey, and depending on who you ask, it's either the biggest security upgrade the internet has seen in decades or a half-finished project that's still leaning on the very system it's supposed to replace.

Both are true at once, and understanding why is worth ten minutes of your time — because passkeys are showing up everywhere whether you've asked for them or not.

What a passkey actually is

Strip away the marketing language and a passkey is a pair of mathematically linked keys. One half, the private key, never leaves your phone, laptop, or security key — it's locked behind your fingerprint, face, or device PIN. The other half, the public key, sits on the website's server and is useless on its own. Think of it less like a password and more like a lock that only your specific key can turn, except copying that key is effectively impossible, because it was never sent anywhere to begin with.

When you log in, the website sends a one-time challenge. Your device signs it using the private key and sends back the answer. The site checks that answer against the public key it has on file. Nothing that could be reused, phished, or leaked in a breach ever travels over the wire — there's no password to type into a fake login page, because there's no password at all.

That single design choice is what makes passkeys phishing-resistant in a way that two-factor codes and even authenticator apps never fully achieved. A stolen password can be reused anywhere. A stolen one-time code can be relayed to a fake site in real time. A passkey is cryptographically tied to the exact website it was created for, so even a perfect copy of a login page can't trick it into signing in.

How far this has actually spread

The numbers are large enough to sound exaggerated. The FIDO Alliance, the industry group behind the underlying standard, says more than 15 billion accounts worldwide can now sign in with a passkey. Google alone has said its users have created passkeys on hundreds of millions of accounts. Amazon added passkey sign-in and saw well over a hundred million users set one up within the first year. Microsoft made passkeys the default option for brand-new accounts back in May 2025, and reported a sharp jump in passwordless sign-ins afterward.

Apple, Google, and Microsoft all store and sync passkeys through their own systems — iCloud Keychain, Google Password Manager, and Windows Hello, respectively — so once you set one up on one device, it generally follows you to your others inside the same ecosystem. Major password managers, including 1Password, Bitwarden, and Dashlane, now store passkeys too, which helps if you don't want to be locked into a single company's vault.

But creation isn't the same as replacement. Independent estimates suggest the overwhelming majority of everyday logins — by some counts, over 90 percent — still involve typing an actual password. Most banks, government portals, and older business systems haven't added passkey support at all. What's really happened is that a few hundred major platforms, mostly the largest tech and retail companies, have rolled it out, while the long tail of the internet hasn't caught up. Passkeys have gone mainstream at the top of the web and stayed rare everywhere else.

The catch nobody puts in the ads

Passkeys solve phishing better than almost anything that came before them, but "phishing-resistant" doesn't mean "attack-proof," and researchers have already found real cracks.

The most concrete one is the downgrade attack. Security researchers at Proofpoint demonstrated that an attacker running a fake login page can trick a browser into reporting itself as an unsupported device — for example, making a Windows PC look like it's running an old version of Safari. The targeted site then falls back to an older, weaker sign-in method, like a text message code, because it assumes the passkey option isn't available. The victim never even sees a passkey prompt; they just get funneled straight into the same phishing trap that's worked for years. This isn't a flaw in the cryptography itself — it's a flaw in how websites handle the moment a passkey isn't offered, and it only works because most sites still keep weaker login methods around as a fallback.

A separate line of research, presented at the Defcon security conference, showed that a malicious browser extension could hijack the passkey creation process itself, generating a rogue key pair the attacker controls before the legitimate one is ever created. Other security researchers pushed back on how serious this specific finding really was in practice, since it requires an attacker to already have malicious code running inside a person's browser — at that point, plenty of other things are already compromised too. Still, it's a reminder that a passkey only protects the login step; it does nothing to defend a device that's already infected with malware.

Then there's the more mundane problem: recovery. The FIDO standard that powers passkeys was never built with a graceful way to recover if you lose every device that held your keys. Lose your only phone, and the fallback for most services is exactly the thing passkeys were meant to retire — an email reset link. Switching from an iPhone to an Android phone, or vice versa, has also historically meant your passkeys didn't come with you, though Apple and other vendors have started building tools to export and import credentials between ecosystems. Until that works smoothly everywhere, moving platforms can feel like starting over.

So should you actually use them

Yes, with a plan rather than blind faith. Passkeys are a genuine, measurable improvement over passwords, particularly against the phishing and credential-stuffing attacks that account for the vast majority of account takeovers. Turning one on for your Google, Apple, Microsoft, or Amazon account takes a couple of minutes and removes an entire category of attack from the table.

But treat it as one layer, not a replacement for good habits. Keep a password manager running for the many sites that haven't added passkey support yet, and make sure it's storing unique passwords rather than reused ones. Leave two-factor authentication turned on for accounts that support both, especially anything tied to your finances or email, since email is usually the master key to everything else. And if a site you normally use with a passkey suddenly throws an error and asks you to log in "a different way," treat that as a red flag rather than a technical hiccup — it's exactly the moment downgrade attacks are built to exploit.

The password isn't dead. It's more accurate to say it's been demoted, unevenly, account by account, while a genuinely better system slowly gets built up around it. For now, the safest approach is using passkeys wherever they're offered and staying just as careful everywhere they aren't.