Passkeys Replace Passwords as Digital Authentication Evolves Globally

The password, that string of characters you've memorized or written on a sticky note, is beginning its exit from digital life. In its place, a new form of authentication called passkeys is spreading across the globe—a shift driven not by convenience alone, but by a fundamental weakness in the old system: passwords can be stolen, intercepted, and tricked out of users through phishing attacks. One-time passwords, long deployed as a second layer of defense, suffer from the same vulnerability. Passkeys work differently. They rely on cryptographic credentials designed to resist these attacks, making them harder to compromise remotely.

The technology is still unfamiliar to many people in Vietnam, but the ground is already being prepared. The country has been expanding VNeID, its digital identity platform, and rolling out biometric authentication across government and financial services. These systems are quietly teaching millions of Vietnamese how to prove who they are without typing a password—a foundation that could accelerate the shift to passkeys faster than in countries where digital identity infrastructure is already locked in place.

Globally, the adoption curve is steep but still early. The FIDO Alliance, the industry body that sets standards for passwordless authentication, reported in 2026 that five billion passkeys were in active use worldwide. Three-quarters of consumers surveyed had enabled at least one passkey, and nearly half were using them regularly when the option existed. The numbers suggest momentum, though the transition remains incomplete in most markets. Edwardcher Monreal, a principal solutions architect for identity and access management at HID, frames the shift not as a simple swap of one login method for another, but as a recognition that passwords themselves are the problem. "One of the key problems that we have with passwords is that they are phishable," he said. "It's also very easy to steal and replicate." Even OTPs, he noted, remain vulnerable to the same social engineering tactics.

But securing the login screen is only part of the puzzle. As authentication becomes stronger at the front door, the question emerges: where will attackers turn next? Monreal argues that organizations need to look beyond the moment someone enters their credentials. Account opening, device changes, transactions, and account recovery all represent potential weak points in the digital customer journey. This matters more urgently now because artificial intelligence is making it easier to create convincing fake identities, documents, voices, and faces. A 2025 Gartner survey found that 62 percent of organizations had experienced at least one deepfake attack in the previous year, whether through social engineering or automated processes. The implication is clear: verifying someone's identity once at login may no longer be enough to protect an account throughout its life.

Vietnam's position is unusual. Rather than being locked into mature authentication systems, the country is still building its digital identity infrastructure. This creates an opportunity. VNeID is expanding into a broader platform for public services and electronic transactions. The national digital transformation strategy for 2026 through 2030 identifies digital identity and authentication as key shared digital platforms. Monreal compared Vietnam's situation to Singapore's SingPass system, noting that Vietnam could move faster precisely because users are already becoming accustomed to digital identity and biometric verification. The pace will vary by sector—banking, government, and private enterprise have different requirements and different levels of readiness—but regulation and policy can accelerate the shift. Resolution 57-NQ/TW, which places digital transformation at the center of building a digital government, digital economy, and digital society, provides the policy foundation for this evolution.

The transition is not without complications. Device-bound credentials make remote attacks harder, but they create new problems when a user loses, replaces, or changes a device. Account recovery and device enrollment must be secured as carefully as the initial enrollment process. Biometrics raise privacy questions about where data is stored and processed. One approach is to verify users locally on their devices, so biometric information never travels to a central server. Monreal describes the principle this way: "Verify the person locally, protect the credential on the device and share only the information needed by the service." In this framing, the move beyond passwords is not about finding a single technology that solves digital security. It is about redesigning authentication itself—from a one-time checkpoint at login to a system that continuously considers the person, the device, and the action throughout the digital journey.

Over the next three to five years, passkeys are expected to become increasingly common, and authentication will become more context-driven. Fewer passwords and OTPs may make digital services easier to use. But the underlying challenge remains unchanged: businesses must still ensure that the person behind each digital action is who they claim to be.