In early 2025, Microsoft began nudging new account holders to skip password creation entirely and register a passkey instead. Google had already reported that more than 400 million accounts had used passkeys at least once. Apple, for its part, automatically offers a passkey option every time a user signs into a supported app on an iPhone running iOS 17 or later. After decades of telling people to pick stronger passwords, the three companies that control nearly every consumer operating system are now steering users toward a replacement that doesn’t involve typing a secret at all.
The technology behind that replacement is straightforward in concept: instead of memorizing a string of characters, you unlock your account with a fingerprint scan, a face scan, or your device PIN. Behind the scenes, a cryptographic key pair does the actual authenticating, and the private half of that pair never leaves your phone or laptop. For the billions of accounts still protected by reused or stolen passwords, the shift matters. Credential theft remains the single most common path into a data breach, according to Verizon’s 2024 Data Breach Investigations Report. Passkeys are designed to close that path at the protocol level.
Why federal agencies call passkeys the gold standard
Two U.S. government authorities have drawn a sharp line between passkeys and every other form of login verification. The Cybersecurity and Infrastructure Security Agency states that FIDO and WebAuthn represent the only widely available form of phishing-resistant authentication. That classification puts passkeys in a category above SMS codes, email links, and authenticator-app one-time passwords.
NIST’s SP 800-63B, the federal government’s primary digital-identity guideline, explains the mechanism. When you register a passkey on a website, the credential is cryptographically locked to that site’s exact domain name through a process called verifier name binding. A phishing page hosted on a lookalike URL cannot trigger the credential because the domain does not match. The latest public draft of NIST SP 800-63B (Revision 4) explicitly names WebAuthn, the protocol underlying FIDO2 passkeys, as an example that meets this requirement.
The same guideline draws a hard line against older methods. Any authenticator that requires manual entry of a code, whether generated by an app or delivered by text message, does not qualify as phishing resistant. The reasoning is simple: if you can type a code into a legitimate browser window, you can also type it into a fake one controlled by an attacker. Passkeys eliminate that manual step. Your device performs a cryptographic handshake with the server, and you authorize it locally with a biometric or device PIN. No secret ever crosses the network in a replayable form.
Academic research reinforces the point. A 2017 USENIX study on public-key credential security cited in the NIST guideline examined how domain-bound keys resist remote interception. Work from MIT’s Computer Science and Artificial Intelligence Laboratory contributed to the Web Authentication specification that the W3C adopted as a formal recommendation. Together, these references form the technical backbone for the claim that passkeys block phishing at the protocol level, not through user vigilance alone.
What Big Tech has actually shipped
The FIDO Alliance, whose board includes Apple, Google, and Microsoft, published a joint commitment in 2022 to build passkey support into their platforms. Since then, each company has moved at its own pace, but the direction is uniform.
Google enabled passkey sign-in across all Google Accounts in late 2023 and reported surpassing 400 million passkey-enabled accounts by early 2025. The company also integrated passkey support into Chrome and Android, so third-party sites and apps can offer the option without building their own infrastructure from scratch.
Apple embedded passkey creation into iCloud Keychain starting with iOS 16 and macOS Ventura, then expanded automatic passkey prompts in iOS 17 and iOS 18. Because iCloud Keychain syncs across Apple devices, a passkey created on an iPhone is immediately available on a Mac or iPad signed into the same Apple ID.
Microsoft began defaulting new personal accounts to passwordless sign-in in 2025, prompting users to set up a passkey during registration rather than choosing a password. The company also expanded passkey support in Windows 11 and its Authenticator app, aiming to reduce reliance on passwords across both consumer and enterprise accounts.
Beyond the big three, major services including Amazon, PayPal, GitHub, and several large banks have rolled out passkey options. Password managers such as 1Password, Bitwarden, and Dashlane now store and sync passkeys alongside traditional credentials, giving users a way to manage passkeys across ecosystems without being locked to a single vendor’s cloud.
What remains uncertain
The technical case for passkeys is strong. The open questions are about deployment, usability, and the messy realities of billions of people changing a decades-old habit.
Adoption data is thin. Neither CISA nor NIST has published a dataset tracking passkey enrollment rates across consumer platforms. Google’s 400-million figure is the most concrete public number, but it measures accounts that have used a passkey at least once, not accounts that have abandoned passwords entirely. Without richer telemetry, the actual pace of the transition is hard to gauge.
Biometric edge cases are underreported. Lab accuracy for fingerprint and facial-recognition sensors is well documented, but real-world failure rates, including false rejections from wet fingers, scarred fingertips, or low-light conditions, remain largely unpublished at scale. For enterprises considering a mandatory passkey rollout, this gap matters. A policy that forces passkeys on every employee could reduce account-takeover incidents while increasing help-desk calls from users whose scans fail.
Account recovery is harder. Passwords can be reset with an email link. Passkeys, because they are bound to a specific device, create a tougher recovery problem when that device is lost, stolen, or broken. Cloud-synced passkeys (through iCloud Keychain, Google Password Manager, or a third-party manager) ease this considerably, but the security tradeoffs of syncing a credential across multiple devices have not been fully evaluated in public federal guidance. NIST’s current guideline addresses the cryptographic properties of the authentication event itself, not the lifecycle management of synced keys across phones, tablets, and laptops.
Cross-platform friction persists. FIDO and WebAuthn are open standards, but users live inside vendor ecosystems. A passkey created on an iPhone syncs effortlessly to a Mac but requires a QR-code-based Bluetooth handshake to work on a Windows laptop. Third-party password managers that store passkeys can bridge this gap, though the experience is still less seamless than typing a password into any browser on any device. The standards solve phishing at the protocol layer; they do not dictate how vendors design migration tools or backup options when people switch hardware.
Privacy assurances rest on trust. Biometric data used to unlock a passkey is supposed to stay on the device and never reach the website being accessed. That model is central to how vendors describe their implementations. Independent auditing at scale to confirm that device manufacturers consistently follow best practices for storing and processing biometric templates is limited. For now, users and organizations must largely rely on platform assurances that biometric checks are isolated from broader data collection.
What a passkey login actually looks and feels like
For readers who have never tried one, the experience is disarmingly simple. When you visit a site that supports passkeys and choose to register one, your device generates a key pair. The public key goes to the site’s server. The private key stays in your device’s secure hardware (Apple’s Secure Enclave, Google’s Titan chip, or the TPM in a Windows PC). No shared secret exists for an attacker to steal from the server side.
The next time you sign in, the site sends a challenge to your device. Your phone or laptop prompts you to verify your identity with a fingerprint, face scan, or device PIN. If the biometric matches, the device signs the challenge with the private key and sends the signed response back. The whole process typically takes two to three seconds, faster than typing a password and far faster than waiting for a text-message code.
If your device does not have a biometric sensor, a device PIN or screen-lock pattern serves the same role. Passkeys do not require a fingerprint reader, though one makes the process quicker.
Where the password-to-passkey transition stands now
As of mid-2026, the transition is real but uneven. The infrastructure is in place across the dominant platforms, and hundreds of major websites accept passkeys. Yet most online accounts worldwide still rely on passwords, and many smaller services have not added passkey support. The gap between what the technology can do and what most people actually use day to day remains wide.
For individual users, the practical step is straightforward: check whether the services you use most, starting with Google, Apple, and Microsoft accounts, already support passkeys, and enable them where available. The setup usually takes less than two minutes per account. Once configured, everyday sign-ins become faster and quietly close off the most common phishing techniques.
Organizations face a more complex calculus. Security teams can pilot passkeys with a subset of users whose devices and workflows are relatively uniform, such as employees on managed laptops and corporate smartphones. Early pilots should track not only security incidents but also usability metrics: enrollment completion rates, help-desk tickets, and recovery scenarios when devices are lost. Those results can inform whether to make passkeys the default, keep them as an opt-in enhancement, or pair them with legacy password options for edge cases.
Both groups should treat current federal guidance as a floor, not a ceiling. CISA and NIST have already classified passkeys as the only widely available phishing-resistant login method. The remaining work is operational: building deployment patterns, recovery playbooks, and user education that translate strong cryptography into fewer successful attacks. The technology is proven to resist phishing by design. Whether the world adopts it fast enough to bend the breach curve is the question that 2026 and beyond will answer.
More from Morning Overview
*This article was researched with the help of AI, with human editors creating the final content.
