News, business, technology and lifestyle
Grab The Data

Passkeys Explained: How They Replace Passwords and How to Start Using Them

Passkeys now handle more than a third of sign-ins at the services that measure them. Here is how they work, why they stop phishing, and how to set one up on your phone or computer.

For decades, logging in has meant typing a password, and for just as long passwords have been the weakest link in online security. They get reused, guessed, leaked in breaches and typed into convincing fake websites. Passkeys are the industry’s attempt to retire them, and in 2026 they have moved from an experiment to something most people already have on their phone.

How big passkeys have become

The FIDO Alliance, the industry body behind the standard, estimated in May 2026 that around 5 billion passkeys were in use worldwide. Its consumer survey that month, covering 11,000 people in ten countries, found that 90% had heard of passkeys, 75% had enabled one on at least one account, and 49% used them regularly when offered.

The Alliance’s Passkey Index, published in October 2026 and based on data from participating consumer services, reports that passkeys now account for about 36% of successful sign-ins at those services, up from roughly 26% a year earlier. Coverage of that report also puts the global estimate at around 7 billion passkeys. FIDO itself describes the year-on-year comparisons as directional, because the group of participating companies changed, but the trend is unmistakable.

Microsoft says hundreds of millions of people already sign in to its consumer services, such as Xbox and OneDrive, with passkeys every day, and it made passkeys the default for new Microsoft accounts in 2025.

How a passkey works

A passkey is a pair of cryptographic keys created for one specific website or app.

  • The public key is stored by the website. It is not secret; on its own it cannot be used to sign in.
  • The private key stays on your device, or in your password manager, and never leaves it.

When you sign in, the website sends a one-time challenge. Your device signs it with the private key after you unlock it with your fingerprint, face or device PIN, and the website checks the signature with the public key. No password is typed, sent or stored.

That design is what makes passkeys resistant to the attacks that defeat passwords:

  • Phishing: a passkey is tied to the real website’s address, so a look-alike site simply cannot use it.
  • Data breaches: websites only hold public keys, so a stolen database contains nothing an attacker can log in with.
  • Reuse and guessing: every passkey is unique and randomly generated; there is nothing to guess and nothing to reuse.

Your fingerprint or face never leaves your device either. It only unlocks the private key locally.

Faster as well as safer

Security improvements usually make things slower. Passkeys are an exception. According to the FIDO Passkey Index, passkey sign-ins succeeded 93% of the time compared with 78% for passwords combined with traditional one-time codes, and they were around 2.8 times faster, saving roughly 27 seconds per sign-in.

Syncing, backups and switching platforms

Early on, a common worry was losing access when you lose your phone. Today most passkeys are synced: they are backed up through your platform account or password manager, such as Apple’s Passwords app, Google Password Manager or Microsoft’s password manager, and restored when you sign in on a new device.

Moving passkeys between ecosystems has been the slowest part to arrive. Apple added secure credential import and export with iOS 26, and the major platforms are implementing a shared credential exchange standard, but how smoothly you can move from, say, an iPhone to an Android phone still depends on the providers involved.

How to set up your first passkey

  1. Start with an important account. Google, Apple, Microsoft, Amazon, PayPal and most large services now offer passkeys. Look in the account’s Security or Sign-in settings for “Passkeys” or “Create a passkey”.
  2. Choose where to save it. Your phone or computer will offer to store it in its built-in password manager, or in a third-party manager if you use one.
  3. Confirm with your fingerprint, face or PIN. That’s it. The next time you sign in, choose the passkey option and unlock your device.
  4. Signing in on someone else’s computer? Choose the option to use a phone. The computer shows a QR code; scan it with your phone, which confirms the sign-in over Bluetooth without the passkey ever leaving your phone.
  5. Keep a recovery method. Make sure your platform account is protected and that you have recovery options set up, since that account is what restores your synced passkeys.

The catch

Passkeys are not yet a complete replacement. Most services still keep a password as a fallback, which means the old weak point has not disappeared. Usage also trails enrolment: FIDO’s figures show more accounts have a passkey than actually use one to sign in. And workplaces lag consumers. The Alliance’s 2026 workforce survey found 57% of organisations still rely on phishable methods for employees’ everyday sign-ins.

Still, the direction is set. Every major platform supports passkeys, more than half of the busiest websites offer them, and they remove whole categories of attack while making sign-in quicker. If you set up only one security improvement this year, a passkey on your main email account is a good place to start.

Sources