Passkeys have reached a new milestone, FIDO now estimates that 7 billion passkeys are in use worldwide. And new data suggests something even more important is happening. People aren’t just creating passkeys, but they are routinely using them to authenticate.
And with Authenticate 2026 just around the corner, there is no better time to look at how far the ecosystem has come, what’s driving adoption and what it will take to make passkeys the default way we sign in.
Today, we’re releasing the 2026 Passkey Index, drawing data from 15 major consumer services from around the world, up from nine last year: Abanca, Amazon, Banesco, JPMorgan Chase, CVS, Google, KDDI, LY Corporation, Mercari, Microsoft, NTT DOCOMO, PayPal, Shopify, TikTok and WhatsApp. The findings tell a great story.
Passkeys are becoming mainstream
So what did we learn? Above all, passkeys have moved from deployment to adoption. Last year’s Index showed that passkeys were available to almost every user. This year’s shows they’re being used routinely. More than a third of successful sign-ins now use a passkey, and while enrollment has grown, the bigger change is that people who have a passkey are using it more of the time.
The benefits are clearly established, too. Passkey sign-ins succeed more often than passwords and traditional MFA, and are nearly three times faster. Every participant that measures phishing reported fewer successful attacks since deploying passkeys, and every participant that shared savings data reported lower SMS OTP costs.
The next phase is about making passkeys the default, moving from offering them as an option to building experiences around them, and organizations are already heading that way: most participants plan to offer passwordless accounts in the next 12 months. There’s much more in the full report, so do download it and dig in.
There’s still work to do, though. The gap between having a passkey and using it has narrowed sharply since last year, but it hasn’t closed completely. Two participants point to an explanation: their sign-in flows offer a password or code before offering the passkey, even to people who have a passkey.
A new tool to help organizations get there
Making the passkeys easy to discover, implement and use consistently is what drives adoption. That’s why at Authenticate we will be introducing our new FIDO Passkey Rubric. It’s a practical checklist, soon to be available on Passkey Central, that brings together FIDO’s research, UX guidance and expert knowledge. It covers creating a passkey, using it for everyday sign-ins and managing it over time. Each item explains what to do, why it matters and where to find more detail. It also flags common mistakes, like allowing only one passkey per account, and capabilities that are easy to overlook, such as automatic passkey upgrades.
The Rubric features bronze-through-platinum levels that teams can use to assess their own progress. These are for internal self-assessment, not certification. Platinum covers the most advanced capabilities, such as removing passwords entirely and supporting passkeys across multiple domains. If you’re just getting started or close to going passwordless, we hope the Passkey Rubric gives your team a shared reference for where you are today and what to improve next.
Helping the ecosystem take the next step
Whether an organization is building its business case, preparing its first deployment or looking to increase adoption, finding the right guidance shouldn’t be another obstacle. That’s why we’ve reorganized Passkey Central around the stages of a deployment, from learning the basics and building the business case through to launch and growth. Content is now grouped by the question you’re trying to answer, making it easier to find and apply the guidance you need. And because Passkey Central was originally written with consumer services in mind, there’s a new section for organizations replacing passwords and phishable MFA for their own employees, with a deployment guide and case studies from Semperis, RSA, MIXI, Wedding Park, Target and Cloudflare.
Passkeys have come a long way in the past year, and the Index shows organizations are ready to go further. Our job is to help them get there, with the evidence, guidance and tools to make passkeys the default way everyone signs in.
All this and much more will be discussed next week at Authenticate, with news and sessions on our digital credentials, agentic commerce, certification, and FDO work areas alongside passkeys. If you’re attending, we look forward to you joining the conversation. And if not, you can follow all the news and coming out of the event here.
