Passkeys Emerge as Password Alternative, But Adoption Remains Uneven

You've probably noticed the option appearing on websites you visit regularly: a button that says "Sign in with passkey" or "Use your fingerprint." It's a small thing, easy to skip past if you're in a hurry. But it represents something larger—a quiet shift in how we prove we are who we say we are online.

Passkeys are a new kind of digital lock. Instead of typing a fourteen-character password full of symbols and numbers you'll never remember, you use your face, your fingerprint, or a PIN you already know. The technology works by splitting authentication into two encrypted pieces—one half lives with you, stored either in a cloud-based password manager or on a physical security key. The other half stays with the service you're trying to access. When you log in, these two halves communicate directly with each other. Neither piece alone is useful; they only work together. It's a fundamentally different approach to the problem passwords have never quite solved.

The momentum started building about eighteen months ago when Google began accepting them. Apple had introduced passkeys to iOS in 2022, but Google's adoption gave the technology real traction. Now roughly one in five of the world's largest hundred websites support them. PayPal, Amazon, Microsoft, and eBay are on board. LinkedIn and WhatsApp have them too. Facebook and Netflix have not yet made the move, but according to Andrew Shikiar, the CEO of the FIDO Alliance—the industry group that developed the underlying technology—it's simply a matter of time.

The security advantage is real and specific. A passkey won't work on any website except the one it was created for, which means phishing scams lose their power. A criminal can't trick you into entering your details on a fake login page because the passkey itself is bound to the legitimate site. And because passkeys use cryptographic security, brute-force attacks—where someone tries thousands of passwords from previous data breaches—simply don't work. The attacker has no password to guess.

But adoption remains uneven, and the user experience varies wildly depending on which service you're setting up. Setting up a passkey on Google is straightforward: a few clicks, a prompt from your password manager, and you're done. Adding one to Microsoft requires more head-scratching over confusing prompts, though it's eventually manageable. LinkedIn and Amazon are easy. Then you try to add multiple passkeys across different devices—one on your password manager, another on a physical security key—and suddenly you're wrestling with authentication failures and unclear error messages. When one journalist tried to add a second passkey to her Google account on a Windows laptop using a Yubico physical key, the password manager authentication failed. She had to try again with her Google Authenticator app. It worked, but only after some frustration.

Logging in, once everything is set up, can be seamless—a click or two and you're in. But friction persists in unexpected places. PayPal's passkeys don't work on Firefox. Amazon asked for a one-time verification code from an authenticator app even though the whole point of passkeys is supposed to be eliminating the need for additional authentication steps. Shikiar explained that it depends on the individual service, and theoretically a passkey has enough built-in protection that other factors shouldn't be necessary. "When the primary factor's un-phishable, other factors aren't necessary," he said. But not every company has implemented it that way.

If you lose the device holding your passkey, the outcome depends on how you stored it. Cloud-based passkeys—the typical method on phones—can be recovered by logging back into your password manager from another device. Physical security keys, though, aren't synced to the cloud. Lose the key and the passkey is gone unless you've kept a backup hardware key. The solution is redundancy: use both cloud and hardware methods, or keep multiple keys.

Experts don't recommend converting all your accounts to passkeys immediately. The setup experience is too inconsistent, and the technology is still in early adoption. Better to start with your most important accounts—email, banking, social media—and get those right. As for your old passwords, you could delete them in theory. Some services like Microsoft already offer that option. But Shikiar says it should be a personal choice. Some people feel extremely nervous about going passwordless, and that's reasonable. If you keep your passwords, just make sure multi-factor authentication is turned on. The transition to passkeys won't happen overnight. But as more services implement them and the setup experience smooths out, the friction will fade. The password, after decades of dominance, is slowly being replaced by something that works more like a key—something you don't memorize, something you can't lose in a phishing attack, something that only opens the door it was made for.