By Gracus Bloom | IT News
For decades, the password has been the little gatekeeper standing between people and their online accounts. We have typed them into email accounts, banking sites, social media, shopping websites and workplace systems. We have been told to make them longer, harder to guess and different for every account.
Then we promptly forget them.
Now the technology industry is attempting a major change: replacing traditional passwords with passkeys, a form of cryptographic authentication designed to make logging in both more secure and easier for users.
The transition isn’t happening overnight, and passwords are not disappearing from the internet tomorrow. But the numbers show that passkeys have moved well beyond a technology experiment. The FIDO Alliance reported in May 2026 that an estimated 5 billion passkeys were in active use worldwide, with 75% of surveyed people having enabled at least one passkey. (FIDO Alliance)
So what exactly is driving the change—and why isn’t everyone thrilled about it?
The Password’s Biggest Problem
The password is remarkably old-fashioned technology.
At its simplest, a password is something a person knows. The problem is that people tend to reuse passwords, choose predictable passwords or store them in ways that can expose them.
Passwords can also be stolen through phishing.
A criminal can create a fake website that looks almost identical to a legitimate banking, shopping or email site. A victim types in a username and password, and the attacker receives the credentials.
The problem doesn’t necessarily stop there. Stolen passwords can be tested against other websites because people frequently reuse credentials.
NIST describes phishing-resistant authentication as authentication designed to prevent authentication secrets or valid authentication outputs from being disclosed to an impostor website. Its current Digital Identity Guidelines identify FIDO/WebAuthn-based authenticators among the technologies capable of providing phishing resistance. (NIST Publications)
That is one of the major reasons the industry wants to move away from passwords.
So What Is a Passkey?
A passkey is fundamentally different from a traditional password.
Instead of asking you to remember a secret string of characters, a passkey uses public-key cryptography.
When you create a passkey for a website or application, a cryptographic key pair is involved. The private portion stays protected by your device or passkey provider, while the corresponding public information can be registered with the service.
When you sign in, your device can ask you to authenticate using something you already use to unlock it:
- Fingerprint
- Face recognition
- Device PIN
- Device passcode
- Security key
The biometric information itself isn’t sent to the website as your password. FIDO explains that biometric processing remains on the user’s device, while the service receives confirmation that the local authentication succeeded. (FIDO Alliance)
That is an important distinction.
Your fingerprint isn’t supposed to become a giant password database sitting on the internet.
The Big Change: Nothing to Remember
Think about the traditional login process.
Username → password → perhaps a text message code → access.
With a passkey, it can become:
Choose account → unlock device → access.
That simplicity is one of the strongest arguments for the technology.
Google reported that within less than a year of launching passkeys, they had been used more than 1 billion times across more than 400 million Google Accounts. Google also reported that passkeys were faster than passwords in its measurements. (blog.google)
For consumers, that means fewer passwords to memorize and fewer password-reset requests.
For businesses, it potentially means fewer customer-support calls involving forgotten passwords.
Why the Industry Is Pushing Passkeys Now
Several forces are arriving at the same time.
1. Phishing is getting harder to control
Traditional phishing attacks remain a major problem.
If an attacker convinces someone to type a password into a fraudulent website, the password can potentially be captured.
Passkeys use cryptographic authentication tied to the legitimate website or service, making conventional credential phishing much more difficult.
NIST specifically recognizes phishing-resistant authentication as an important security capability for protecting sensitive accounts and elevated privileges. (NIST)
2. Password fatigue is real
People have accumulated enormous numbers of online accounts.
Email.
Banking.
Streaming.
Shopping.
Healthcare.
Social media.
Work applications.
Travel.
Utilities.
Remembering a different complicated password for every account is unrealistic for many consumers.
3. Companies want fewer account-recovery headaches
Forgotten-password systems cost organizations time and money.
Passkeys can reduce some of that friction because authentication can be tied to the user’s existing device and credential manager.
4. Phones and computers already contain the necessary hardware
Modern smartphones and computers already support biometrics, secure hardware and device authentication.
The technology doesn’t require every consumer to purchase a specialized security gadget.
The Technology Has Some Serious Momentum
The industry’s progress is becoming difficult to ignore.
According to the FIDO Alliance’s 2026 research:
- 90% of surveyed people globally were aware of passkeys.
- 75% had enabled a passkey on at least one account.
- 49% reported using passkeys regularly when available.
- 68% of organizations had deployed or were actively deploying passkeys for employee sign-ins.
- 82% said fully passwordless authentication was an organizational goal. (FIDO Alliance)
These are survey findings across multiple countries and organizations, not a claim that 75% of every internet user has adopted passkeys.
Still, they demonstrate how quickly the concept has moved into mainstream technology discussions.
The Consumer Resistance Problem
Here comes the interesting part.
Consumers don’t always want technology companies to change the way they log in.
People understand passwords.
They may be annoying, but everyone knows what they are.
Passkeys introduce new questions.
Where is my passkey stored?
What happens if I lose my phone?
What happens when I buy a new computer?
Can I use the passkey on another device?
What happens if I stop using a particular password manager?
Those concerns are legitimate.
Passkeys can be synchronized between devices through credential providers, while device-bound passkeys can remain associated with a particular device or security key. FIDO describes both models. (FIDO Alliance)
NIST has also recognized the importance of recovery and cross-device considerations when deploying syncable authenticators. (NIST)
The “What If I Lose My Phone?” Question
This may be one of the biggest psychological barriers.
People understand what happens when they forget a password:
Click Forgot Password.
Passkeys require users to understand the relationship between their devices, credential managers and accounts.
The good news is that synced passkeys can be available across multiple devices using the same passkey provider.
That means losing one device doesn’t necessarily mean losing access to every passkey.
However, account recovery still matters.
Organizations need carefully designed recovery procedures, particularly for high-value accounts.
A secure authentication system with a terrible recovery process can create an entirely different security problem.
The Industry Has Another Problem: Too Many Ecosystems
Apple, Google, Microsoft, password managers and security companies all participate in the broader passkey ecosystem.
That creates a potential consumer benefit—competition—but also a potential source of confusion.
People don’t necessarily know whether a passkey belongs to:
- Their phone
- Their browser
- Their operating system
- Their password manager
- Their security key
- Their cloud account
Technically, these distinctions matter.
To an ordinary consumer, however, the experience needs to be simple.
If someone clicks “Create Passkey,” the system should ideally explain what is happening without requiring the user to understand public-key cryptography.
Businesses Have Their Own Resistance
Consumers aren’t the only ones with reservations.
Businesses have to worry about:
Integration costs.
Older applications may have been designed around passwords.
Legacy systems.
Some systems simply weren’t built for modern authentication methods.
Employee training.
IT departments have to explain the change.
Recovery.
Organizations need procedures for lost devices and employee departures.
Multiple platforms.
A company may have Windows PCs, iPhones, Android devices, Macs, specialized equipment and older enterprise software.
Regulatory requirements.
Companies operating in highly regulated industries must carefully evaluate authentication systems against applicable security requirements.
The technology may be better suited to some environments than others, particularly during a transition period.
Passwords May Not Disappear Completely
The most important point may be this:
The future is probably not going to be “passkeys everywhere tomorrow.”
The transition is likely to be gradual.
Some websites will support passwords and passkeys simultaneously for years.
Some consumers will prefer traditional password managers.
Some organizations will use hardware security keys.
Others will deploy passkeys through enterprise identity platforms.
And certain legacy systems may continue using passwords for a long time.
Passkeys are therefore better understood as part of a broader shift toward passwordless and phishing-resistant authentication, rather than simply a new password replacement button.
What Happens to Two-Factor Authentication?
This is another area where the terminology can become confusing.
Traditional security often looks like:
Password + SMS code
or
Password + authenticator-app code
Passkeys can potentially provide a phishing-resistant primary authentication factor without requiring the same kind of password-plus-code process.
FIDO specifically describes passkeys as capable of replacing traditional password-plus-one-time-password authentication in many scenarios. (FIDO Alliance)
That doesn’t mean every organization should immediately eliminate every other authentication method.
Security architecture depends on the application, risk level and implementation.
The Potential Impact on Consumers
If passkeys continue to expand, consumers could see several changes.
Fewer passwords
People may gradually have fewer passwords to remember.
Faster logins
A fingerprint, face scan or PIN can be quicker than typing a complicated password.
Less traditional phishing
A properly implemented passkey can resist many conventional phishing techniques.
Fewer password-reset emails
Customer-service departments could potentially handle fewer password-reset requests.
Greater dependence on devices
The user’s phone, computer or security key becomes increasingly important to digital identity.
That last point deserves attention.
The password era made the password the thing you had to protect.
The passkey era shifts some responsibility toward protecting your devices and account-recovery mechanisms.
The New Security Rule: Protect the Device
Passkeys don’t eliminate cybersecurity responsibilities.
A stolen unlocked phone is still a problem.
A compromised account used to synchronize credentials can still be a problem.
Malware remains a problem.
Social engineering remains a problem.
Account recovery remains important.
And passkeys aren’t a magic solution to every cybersecurity attack.
NIST explicitly notes that phishing-resistant authenticators address particular authentication threats rather than every possible attack. (NIST)
That’s why users still need device security, software updates, screen locks and sensible account-recovery practices.
Will Consumers Eventually Forget What a Password Was?
That may sound ridiculous today.
But consider how quickly technology has changed before.
People once memorized telephone numbers because phones didn’t have contact lists.
People carried paper maps.
People stored photographs in albums.
People used physical keys for almost everything.
Technology gradually moved responsibilities from human memory to devices.
Passwords may be headed in the same direction.
Instead of remembering dozens of character combinations, consumers may increasingly authenticate themselves by proving control of a trusted device.
The Password’s Long Goodbye
The password isn’t dead.
Not yet.
But something significant has changed.
Technology companies now have a practical alternative that can make authentication easier for users while addressing important weaknesses associated with password-based sign-ins.
The FIDO Alliance’s 2026 estimate of 5 billion passkeys in active use demonstrates that this is no longer merely a laboratory project. (FIDO Alliance)
NIST’s guidance likewise shows that passkey-style syncable authenticators have become part of serious digital-identity discussions rather than being treated as experimental technology. (NIST)
The remaining challenge may be less about whether the technology works and more about whether the human experience works.
Consumers need understandable recovery options.
Businesses need affordable migration paths.
Developers need interoperability.
And everyone needs to understand what happens when the device that holds the keys is lost.
The password has survived for decades because it is simple—even when it isn’t particularly elegant.
The passkey industry’s challenge is to become simpler without becoming mysterious.
If it succeeds, one day logging into a website may feel less like remembering a secret and more like unlocking the device already sitting in your hand.
And that could be the biggest change of all.
3 PNG illustrations
1. From Password to Passkey
Download PNG
2. Device Authentication
Download PNG
3. The Passwordless Shift
Download PNG
