In May 2025, Microsoft quietly changed a default that had held for decades: every brand-new Microsoft account is now created without a password at all [source: Microsoft, 2025]. Google had already made passkeys a default option for personal accounts, and by late 2024 the FIDO Alliance counted more than 15 billion online accounts that could be signed into with a passkey [source: FIDO Alliance, 2024]. After years of "the password is dead" predictions, the largest platforms have started to act as if it were true. But availability is not the same as adoption, and a phishing-resistant login is not the same as a solved problem. This is what the 2025–2026 shift actually amounts to — and what it leaves unresolved.
What this article covers
- Why the password is cracking now, in 2025–2026
- What a passkey actually is, and why it resists phishing
- The adoption numbers — and the gap between "supported" and "used"
- The security case: what is proven versus what is marketing
- The hard parts: recovery, device lock-in, and portability
- What to watch next
Why the password is cracking now
The case against passwords is not new, but the pressure has become measurable. In its 2025 Data Breach Investigations Report, Verizon found that stolen credentials remained the single most common way attackers first got in, involved in roughly 22% of breaches, with phishing behind another 16% [source: Verizon, 2025]. About 60% of breaches involved a human element — someone clicking, reusing, or being tricked — and stolen credentials showed up in the large majority of basic web-application attacks [source: Verizon, 2025]. Microsoft, for its part, says it now observes on the order of 7,000 password attacks every second, more than double the rate it reported in 2023 [source: Microsoft, 2025].
Passwords fail for a structural reason: they are a shared secret. You type the same string the server stores, which means the string can be phished, reused across sites, leaked in a breach, or guessed. Every mitigation layered on top — complexity rules, rotation, SMS codes — adds friction without removing the underlying weakness. That is the backdrop against which Microsoft, Google, Apple, and a long list of consumer services have moved passkeys from an option to, increasingly, the default path.
The "why now" is the convergence of three things: breach data that keeps pointing at credentials, a standard that is finally shipping on every major operating system and browser, and platform owners deciding to change defaults rather than wait for users to opt in.
What a passkey actually is
A passkey is an implementation of the FIDO2/WebAuthn standards, built on public-key cryptography. When you create one, your device generates a key pair. The public key goes to the website; the private key never leaves your authenticator — your phone, laptop, security key, or a synced credential manager. To sign in, the site sends a challenge, your device signs it with the private key after a local check (a fingerprint, face scan, or PIN), and the site verifies the signature against the public key it stored.
Why it resists phishing
The property that matters most is not the biometric — it is that the private key is bound to the origin, the specific website domain, and never transmitted. A phishing site at a look-alike domain cannot elicit a valid signature, because the browser will only release a passkey to the exact origin that registered it. There is no secret to type, so there is nothing to hand to an attacker who has built a convincing fake login page. This is why standards bodies, not only vendors, describe passkeys as phishing-resistant. NIST's 2024 supplement to its digital identity guidelines recognized syncable authenticators — FIDO passkeys — as phishing-resistant, and the 2025 revision of that framework folds passkeys into its higher assurance levels [source: NIST, 2024]. The UK's National Cyber Security Centre puts it plainly: passkeys "can't be guessed" and "can't be phished" [source: NCSC, 2025].
That is a genuine, structural improvement over a typed password, and it is the strongest part of the case for passkeys. Everything after this point is more contested.
The adoption numbers — and what they don't say
The headline figures are large. The FIDO Alliance reported that by the end of 2024, more than 15 billion online accounts could use passkeys, roughly double the year before [source: FIDO Alliance, 2024]. Google said 800 million of its accounts had used passkeys, with more than 2.5 billion passkey sign-ins over two years; Amazon reported 175 million passkeys created for signing in to its site [source: FIDO Alliance, 2024]. A 2025 FIDO survey found that 74% of consumers were aware of passkeys and 69% had enabled one on at least one account [source: FIDO Alliance, 2025].
These numbers are real, but they answer narrower questions than they appear to. "15 billion accounts can use passkeys" is a statement about availability — how many services support the option — not about how many people rely on it. "800 million accounts have used passkeys" counts accounts that created or enabled at least one passkey, not accounts that sign in with one every day. The same 2025 survey that found 69% enablement also found that only 38% of active users said they enable passkeys "whenever possible" [source: FIDO Alliance, 2025]. The distance between "I turned it on once" and "this is how I log in" is where the real adoption story lives, and it is smaller than the top-line figures suggest.
A skeptical read, offered in mid-2026 by 9to5Mac, is worth holding alongside the milestones: even a security-attentive user can go a full week authenticating mostly with ordinary passwords, and large consumer services — the piece names Instagram, Spotify, and Netflix among them — still lacked passkey support [source: 9to5Mac, 2026]. Fragmented coverage means most people cannot go passwordless even if they want to. Availability is climbing fast; day-to-day reliance is following more slowly.
The security case: proven versus marketing
It helps to separate two kinds of claim that often arrive bundled together.
What is independently supported
Phishing resistance is the verified part. It follows from how WebAuthn binds credentials to an origin, and it is endorsed by non-commercial authorities — NIST and the NCSC among them — rather than resting on vendor assertion alone [source: NIST, 2024][source: NCSC, 2025]. Because there is no reusable secret, credential-stuffing and password-reuse attacks — the very patterns the Verizon report flags as dominant — do not apply to a passkey login in the same way [source: Verizon, 2025].
What is vendor telemetry
The convenience and success-rate figures are a different category. Microsoft reports that passkey sign-ins succeed about 98% of the time versus roughly 32% for passwords, and are "eight times faster" than a password plus multifactor step [source: Microsoft, 2025]. Google cites a 30% higher sign-in success rate and about 20% faster sign-ins [source: FIDO Alliance, 2024]. The NCSC's own estimate is roughly 8 seconds for a passkey versus 69 seconds for password-plus-MFA [source: NCSC, 2025]. These are plausible and directionally consistent, but they are company telemetry, not independent audits, and comparisons can be confounded: users who adopt passkeys early may be more technically confident, which would inflate the success gap on its own. The right way to read them is as strong signals of a better experience, not as precise, externally verified constants. The FIDO Alliance's 2025 Passkey Index, which aggregates deployment data from Amazon, Google, Microsoft, PayPal, Target, TikTok and others, is an attempt to move these benefits toward measured, multi-operator evidence rather than single-vendor marketing [source: FIDO Alliance, 2025].
The hard parts: recovery, lock-in, and portability
If phishing resistance is the strongest argument for passkeys, account recovery is the weakest link — and critics from consumer press to national security agencies agree on it.
Recovery is the new attack surface
The FIDO2 standard has no built-in recovery flow of its own. If you lose every device that holds your passkeys, the fallback is usually an email reset link or a support process — the exact phishable channel passkeys were meant to retire [source: 9to5Mac, 2026]. The NCSC makes the same structural point: as passkeys frustrate direct attacks, adversaries will "increasingly shift their focus" to weaker account-recovery paths [source: NCSC, 2025]. A login is only as strong as the way you get back in when you are locked out, and today that back door often remains a password or a code.
Device dependence and lock-in
Device-bound passkeys — those that never leave a single phone or hardware key — offer the strongest isolation but the least portability: lose the device and you can lose the account. Synced passkeys solve that by copying the private key across a vendor's "sync fabric," such as iCloud Keychain or Google Password Manager, which NIST permits at its AAL2 assurance level [source: NIST, 2024]. But syncing trades device isolation for dependence on the cloud account holding the keys, and it tends to lock you into one ecosystem. Moving passkeys between Apple, Google, and third-party managers is, in the NCSC's words, "currently challenging" [source: NCSC, 2025]. Industry work on a Credential Exchange Protocol aims to make that portable, but until it is widely live, switching platforms can turn "passwordless" into a different kind of lock-in [source: 9to5Mac, 2026].
Fragmentation and the unfinished transition
There are quieter frictions too. Different platforms use different words for the same passkey flow, which the NCSC notes can confuse users [source: NCSC, 2025]. Enterprises hesitate because recovery and lifecycle management are harder to standardize at scale [source: 9to5Mac, 2026]. And because coverage is uneven, most services keep the password field as a backup — which means the phishing surface a passkey closes on the front door is often still open at the side entrance.
What to watch
The direction of travel is clear enough: passwords are being demoted from the default to the fallback, and the cryptography underneath passkeys is sound and independently endorsed. The open questions are not about whether the math works but about the plumbing around it. Watch three things over the next year. First, whether usage — habitual sign-ins, not one-time enablement — closes the gap with the headline availability numbers, and whether reports like the FIDO Passkey Index give us measured rather than announced figures. Second, whether the Credential Exchange Protocol and cross-vendor portability mature enough that a passkey feels like something you own rather than something your platform holds. Third, whether recovery gets re-engineered so that the way back into an account is as phishing-resistant as the way in — because until it is, the password's ghost lingers at exactly the point where accounts are most often lost. Passkeys are the most serious challenge to the password in a generation. Whether they finish the job depends less on adoption slogans than on those unglamorous details.