You've likely noticed passkey support popping up more often, yet the password field on login screens refuses to vanish. According to FIDO Alliance's 2026 survey, passkey awareness has reached 90%, and an estimated 5 billion passkeys are now in use worldwide. Even so, most companies still run passwords alongside them. This isn't a sign that adoption has stalled. Rather, there's a real gap between being able to log in with a common standard and being able to carry your keys across different environments, recover safely if you lose a device, and finally retire the old authentication systems.
The Gap Between 5 Billion in Use and the Passwords That Remain
The "5 billion" figure that FIDO Alliance published on May 7, 2026, is an estimate of passkeys currently in use, derived from public information and FIDO's internal deployment data. It does not mean 5 billion users or 5 billion accounts. In a separate survey conducted the same April among 11,000 consumers across 10 countries, 90% said they were aware of passkeys, and 75% had enabled them on at least some accounts. Only 49% said they regularly use passkeys whenever the option is available.
There's a substantial gap between "can use," "has registered," and "uses routinely." The 2025 FIDO Passkey Index reflects the same pattern. Across nine companies including Amazon, Google, and Microsoft, accounts where passkeys could be used reached 93%, but only 36% had actually registered one, and passkeys accounted for just 26% of all logins. For example, someone might create a passkey once on a shopping site, but if that same person still uses a password for their bank or workplace, the passkey count rises without their overall life becoming passwordless.
The often-cited 93% versus 63% login success rate figure also requires context. This isn't from the 2026 consumer survey — it comes from real-world operational data collected from the nine companies participating in the 2025 Passkey Index. Moreover, the 63% figure being compared isn't limited to passwords; it covers "other authentication methods" broadly, including social login, multi-factor authentication (MFA), and one-time passwords (OTP). The 30-point gap does support passkeys' ease of use, but it isn't a like-for-like comparison across every login scenario worldwide.
Breaking down how these numbers are counted reveals the real state of adoption. "Registration adoption" — the growth in people who have created at least one passkey — has advanced significantly. "Usage adoption," where users actually choose a passkey every time, is still in progress. And "authentication system replacement," where services stop storing passwords altogether and remove password-reset screens, lags even further behind. The 5 billion figure strongly reflects the first two categories, but it doesn't mean the third has been completed.
How Passkeys Generate a Different Key for Every Site
Passwords work on a shared-secret model: the user and the service both hold the same secret. The user sends a string of characters, and the service checks it against what's stored. If a reused password leaks, attackers can try it on other sites too, and if a user types it into a fake site, it goes straight to the attacker.
Passkeys instead use WebAuthn's public-key cryptography. During registration, the device or passkey provider generates a public-private key pair specific to that service, and only the public key is handed over to the service. The private key stays with the authenticator. During login, the service sends a one-time challenge, and the browser or OS selects the correct passkey. Once the user authorizes with their face, fingerprint, or device PIN, a response signed with the private key is returned, and the service verifies it using the public key. Facial or fingerprint data itself is never sent to the service.
For instance, if you use passkeys with both a bank and a video streaming service, two separate public keys get registered with those two services. If a fake site impersonating the bank requests a signature, the browser and authenticator won't link the fake site's domain to the bank's registered key. Even if a user is fooled by how a screen looks, the authentication process itself checks the actual destination. This is the decisive difference from passwords or OTPs, which rely on humans to verify URLs themselves.
This mechanism resembles a key that changes shape depending on the address it's used at. A fake site can mimic the appearance of the real one, but it can't make you use the key that was created for the real domain. Where the analogy breaks down is that, unlike a physical key, synced passkeys are distributed across multiple devices in encrypted form. Where they sync to, and how they're recovered, becomes a broader issue than the WebAuthn login procedure itself.
Three Boundaries That Remain Outside the Common Standard
Say you want to use a passkey stored on your iPhone within a browser on Windows. You can scan the QR code shown on screen with your iPhone and approve it as a nearby device. This is cross-device authentication — a bridge that lets a key stored on the Apple side be used for that particular login. It doesn't actually move the key itself to Windows or to a different passkey provider.
Interoperability is easier to understand when split into three layers. The first is "login compatibility" — being able to use authenticators from different vendors with any WebAuthn-supporting service — and this layer has become quite mature. The second is "synchronization" within the same provider. iCloud Keychain delivers passkeys across devices tied to an Apple Account. Google Password Manager syncs across multiple operating systems, including macOS and Windows, via Android and Chrome. The third is "cross-provider migration" — moving keys from Apple to Google, or to a different password manager app entirely.
Microsoft is also expanding its options. Windows 11 supports device-bound passkeys stored in Windows Hello, plugin-based passkey managers, external FIDO2 security keys, and nearby smartphones used as authenticators. Synced passkeys from Microsoft Password Manager also appear in browsers and apps via plugins. However, Windows offering multiple entry points is not the same thing as being able to move credentials from iCloud Keychain or Google Password Manager over to the Microsoft side.
The remaining wall sits in that third layer. FIDO Alliance has advanced the Credential Exchange Format (CXF) 1.0, which defines how to safely transfer credentials, to Proposed Standard status. But the Credential Exchange Protocol (CXP), which defines the migration procedure itself, was still at Working Draft status as of August 20, 2026. Being able to pass through a common turnstile is different from being able to transfer your season pass to a different issuer's wallet. Until migration standards catch up with implementation, users need to either register multiple passkeys with the same service or fall back on QR-based authentication using their original device.
The Misconception That TPM Is a Universal Requirement
The WebAuthn specification allows authenticators to be implemented in software, within a device's secure execution environment or Trusted Platform Module (TPM), or as an external security key. So there's no blanket rule that passkeys are unusable without a TPM or Apple's Secure Enclave. These are simply prominent implementations that protect the private key on-device and raise the authenticator's trust level.
Actual usage conditions vary depending on the combination of OS and browser. The chosen provider and any corporate policy also play a role. Windows Hello uses an available TPM for key protection when one exists, and companies can mandate hardware-based protection through policy. Apple's Keychain incorporates the Secure Enclave into key protection. On the other hand, there are also methods that use a smartphone as an external authenticator, or that rely on a different passkey provider altogether. On older PCs or shared devices, the available authenticators and management policies often don't align, which is why passwords tend to stick around.
Shared devices make the difference especially clear. In settings like retail checkout counters or factory terminals, where multiple employees rotate through in short shifts, an operational model relying on passkeys synced to an individual's personal cloud account doesn't fit well. Some worksites don't allow employees to pull out a smartphone every time either. Companies need to choose between device-bound passkeys, external security keys, or smart cards depending on the role, and they must also design for re-registration when a device is lost and for revocation when an employee leaves.
In FIDO Alliance's enterprise survey, the top barriers to adoption were compatibility with legacy systems at 38%, budget at 35%, and device or account recovery at 33%. On the technical and security side, the exportability of synced passkeys and shared-device concerns each accounted for 39%, remote employee registration for 36%, and recovery for 33%. Hardware is part of the friction, but the broader challenge spans legacy business applications, kiosks, and credential management through employee departures and role changes.
When Will Passwords Actually Disappear?
In the same enterprise survey, 68% said they were adopting, piloting, or rolling out passkeys for employees. Yet 57% still use phishable methods as their primary daily authentication, and only 30% of organizations primarily rely on passkey-based authentication. Even after hanging up the "adopted" sign, the password-based entry point can't be closed until existing employees are registered, legacy apps are addressed, shared devices are handled, and emergency recovery is fully replaced.
Among the main reasons organizations haven't moved to a fully passwordless environment, three factors tied at 16% each: current passwords and MFA being considered sufficient, compatibility with legacy systems, and concerns about account recovery. The barrier isn't concentrated in one place. Adding a new login method to a service takes far less time than safely migrating past users and systems over to it.
For users, the deciding factors aren't whether they can create a passkey, but whether they can restore one from the same provider after buying a new device, whether they can rely on sync or QR-based authentication when switching OS, and whether they can register a backup passkey. On the service side, what's needed is a recovery process that can verify identity without falling back to passwords, along with a management screen where registered passkeys can be reviewed and revoked. The survey found that 89% of organizations feel confident about their recovery process — this isn't an unsolvable problem.
If a user who loses their smartphone can reset their password using nothing more than an email link, then an attacker who takes over that email account can walk the exact same path. Security isn't determined by the passkey login screen — it's determined by whatever recovery path remains as the last resort. Among the organizations in FIDO's survey that expressed confidence in their recovery process, most combined secure administrator procedures, cloud-based recovery features, and registration across multiple devices. If users are given a backup credential and services are designed so a single credential can be revoked, there's less reason to keep a password around as an emergency exit.
Passkey adoption is already well underway. What determines when passwords finally disappear isn't the total registration count, but whether a safe migration path exists even for the oldest users and devices, and whether phishable fallbacks can truly be closed off. It's the services that combine a fully implemented cross-provider migration standard with password-free recovery that will be the first to genuinely transform their login screens.