Passkeys Are Finally Replacing Passwords. Here Is How to Switch

The short answer: turn on passkeys for the handful of accounts everything else hangs off, keep a recovery plan behind them, and do not expect your passwords to disappear this year. Passkeys are a real improvement in one way, phishing resistance, and worse than passwords in one way, portability when something goes wrong.

What a passkey actually is

A passkey is a cryptographic key pair. When you create one for a site, your device generates two mathematically linked values. The public key goes to the site. The private key stays on your device, or in the encrypted store your device syncs to, and is never sent to the site at all.

When you sign in, the site sends a challenge. Your device unlocks the private key, usually behind a fingerprint, face scan or PIN, signs the challenge, and returns the signature, which the site checks against the public key it holds. No shared secret crosses the network, so there is nothing on the server to steal and replay. A breach of the site yields a list of public keys, useless on their own.

The standards come from the FIDO Alliance and the World Wide Web Consortium. FIDO2 combines the Web Authentication API, known as WebAuthn, built into browsers and operating systems, with the Client to Authenticator Protocol, which lets an external device such as a security key act as the authenticator. The FIDO Alliance describes passkeys as cryptographic key pairs in which every passkey is unique and bound to the service domain, which is why one site cannot use your passkey to identify you at another.

What genuinely improves

The real gain is phishing resistance. The National Institute of Standards and Technology, in Special Publication 800-63B-4, “Digital Identity Guidelines: Authentication and Authenticator Management,” published 31 July 2025, defines it in section 3.2.5 as the ability of the authentication protocol to prevent the disclosure of authentication secrets and valid authenticator outputs to an impostor verifier. Section 3.2.5.2 gives the mechanism: the authenticator output is cryptographically bound to an identifier of the verifier, and NIST names WebAuthn as providing this through verifier name binding, choosing the secret based on the authenticated domain name of the site.

In practice, a lookalike domain cannot collect anything usable. If you land on a convincing fake of your bank, your device has no passkey for that domain and will not produce one. You are not being asked to notice the misspelling; the browser refuses to cooperate on your behalf. That is the key difference from every previous method, all of which could be relayed by a patient person in the middle.

The Cybersecurity and Infrastructure Security Agency reached the same conclusion in its October 2022 fact sheet “Implementing Phishing-Resistant MFA,” which states that the only widely available phishing-resistant authentication is FIDO and WebAuthn authentication. It describes text-message and voice one-time codes as vulnerable to phishing, SS7 and SIM swap attacks and recommends them only as a last resort, and describes push approval without number matching as vulnerable to push bombing.

What does not improve

A passkey protects the front door, and most accounts have side doors. If a site lets you reset access with a code sent by text message, the account is only as strong as your carrier’s resistance to a SIM swap. If your email can be recovered with a security question, every account using that email inherits the weakness. Passkeys also do nothing about malware, a support agent talked into resetting an account, or your being persuaded to authorise a payment you should not have made. They solve credential theft, not social engineering, and a large share of real-world loss is social engineering.

The four frictions nobody puts in the marketing

Account recovery

This is the weakest part of the system. NIST published a supplement in April 2024, “Incorporating Syncable Authenticators Into NIST SP 800-63B,” since absorbed into the fourth revision. It identified the risks plainly: keys can be shared to devices belonging to other users, the cloud service holding encrypted keys is itself an attack surface, cloud-based account recovery can weaken the authenticator, and there is no centralised revocation mechanism for synced keys.

Read the third point again. If an attacker can recover the account that holds your passkeys, they can recover your passkeys. The strength of a passkey is capped by the strength of the recovery path for the account storing it, and for most people that is a consumer platform account protected by an email address and a phone number.

Device loss

Passkeys on a modern phone or computer usually sync to a platform account, so a lost phone is an inconvenience rather than a catastrophe: sign in to a replacement device and the passkeys reappear. But that is the design NIST flags, and your authentication now depends on a chain of a device, a platform account, and whatever that platform uses to verify you on new hardware.

A hardware security key does not sync, which makes it stronger and more fragile at once. NIST’s fourth revision draws the line here: syncable authenticators can meet Authentication Assurance Level 2, while Level 3 requires keys that cannot be exported. If you use one, you need at least two, enrolled on every account.

Syncing across ecosystems

A passkey created in one ecosystem has historically been hard to move to another. Changing phone platform, or moving from a platform keychain to an independent password manager, often meant re-enrolling account by account. The FIDO Alliance has addressed this with the Credential Exchange Format and Credential Exchange Protocol, the Format version 1.0 review draft published on 13 March 2025, which define how credentials including passkeys transfer securely between providers. Support is arriving but is not universal, and passkeys remain easier to create than to relocate.

Sites that keep the password anyway

On many services, adding a passkey does not remove the password. It adds a faster way to sign in while the old password continues to exist, still reusable, still phishable. If the password remains a valid route in, you have gained convenience and lost nothing, but you have not gained the security benefit you were promised. Check, per account, whether the password can be deleted.

Where it cannot, NIST’s section 3.1.1.2 sets the standard for what remains: at least 15 characters when a password is the single factor, 8 alongside another factor, no composition rules such as required mixtures of character types, no forced periodic changes, and a blocklist check against known compromised values.

A worked example: the phone goes in the river

Suppose you have moved six accounts to passkeys, all in your phone’s platform keychain, and the phone is destroyed on a Saturday. The recovery path is: get a device, sign in to the platform account, restore the keychain. Whether that is a twenty minute problem or a week-long one depends on how you sign in to the platform account on new hardware. If it needs a code sent to the number in the destroyed phone, you need a replacement SIM before you can authenticate anywhere. If it needs a passcode you have not typed in two years because you always used your face, you need to remember it.

The fix takes ten minutes, before anything goes wrong. Write down the platform account recovery method and test it. Keep one physical route that does not involve the phone: printed recovery codes in a drawer, or a hardware key as a second authenticator. Know your device passcode independently of your face or fingerprint. That is the difference between passkeys being an upgrade and passkeys being a single point of failure.

Which accounts to switch first

An explicit decision rule

Add a passkey to an account when you can answer, without looking anything up, how you would get back in if your primary device stopped existing right now. If you cannot answer, fix the recovery path first and add the passkey second. In that order, passkeys strictly improve your position. In the wrong order, they concentrate risk into one device and one platform account, which is worse than a good password manager.

What the adoption numbers do and do not tell you

The FIDO Alliance published “The State of Passkeys 2026: Global Consumer and Workforce Report,” based on an April 2026 survey of 11,000 consumers across 10 countries and 1,400 decision-makers at organisations with more than 500 employees. It reports that 90 percent of consumers are aware of passkeys, 75 percent have enabled them on at least some accounts, and 68 percent of organisations have deployed, are deploying or are piloting them. Bear in mind that the FIDO Alliance promotes the standard, that these are self-reported, and that the same report puts 57 percent of organisations still relying on phishable authentication as their primary sign-in.

The FIDO Alliance also published a Passkey Index in October 2025, produced with the research firm Liminal from a confidential survey of nine member companies that had run passkeys for one to three years. It reports a 93 percent sign-in success rate for passkeys against 63 percent for other methods, and an average sign-in time of 8.5 seconds against 31.2 seconds for traditional multi-factor authentication. Those are large effects, reported by nine very large companies to the organisation whose standard it is. Treat them as the ceiling.

How to turn one on

1. Sign in normally on a device you trust, then open security settings and look for “passkey” or “passwordless.”
2. Create it. The fingerprint, face scan or PIN unlocks the private key locally; it is not sent anywhere.
3. Check whether the site now lets you delete the password, and delete it if your recovery path works.
4. Enrol a second authenticator if allowed, and write the recovery codes on paper.

Where these figures come from

National Institute of Standards and Technology Special Publication 800-63B-4, “Digital Identity Guidelines: Authentication and Authenticator Management,” July 2025, and Special Publication 800-63B supplement 1, “Incorporating Syncable Authenticators Into NIST SP 800-63B,” April 2024. Cybersecurity and Infrastructure Security Agency fact sheet, “Implementing Phishing-Resistant MFA,” October 2022. FIDO Alliance, “The State of Passkeys 2026: Global Consumer and Workforce Report”; FIDO Alliance Passkey Index, October 2025; FIDO Alliance Credential Exchange Format version 1.0 review draft, March 2025; and FIDO Alliance and World Wide Web Consortium specifications for FIDO2, WebAuthn and the Client to Authenticator Protocol.

The honest ending

Passkeys fix phishing, the attack that has quietly defeated every other authentication method for a decade. That is worth acting on. But the industry has replaced a problem people understand, protecting a secret, with one they do not, managing a chain of devices and platform accounts with no centralised way to revoke a key and no consistent way to move one. For most people the trade is favourable. For anyone who has been locked out of a platform account it is not obviously favourable at all, and the passwordless future being described is still, on most sites, a password with a faster login in front of it.

General information, current as of September 2026.