Passkeys are going mainstream: what that means for you

The password problem

Passwords have two big weaknesses. People reuse them, so one leak opens many doors. And people can be tricked into typing them into fake websites, which is called phishing. Breach after breach, including the Gyazo breach in September 2026, shows how often passwords end up in the wrong hands.

A passkey is designed to remove both problems. You still prove it is you, but there is no password to remember, reuse or give away.

How a passkey works, in everyday terms

Imagine a special lock and key. When you create a passkey for a website, your phone or computer makes a matching pair: the website keeps the lock (called the public key) and your device keeps the key (the private key), sealed away where apps cannot read it.

When you sign in, the website sends a small challenge. Your device asks you to unlock it with your face, fingerprint or screen PIN, then uses the hidden key to answer. The website checks the answer with its lock. The key itself never leaves your device, so there is nothing for a fake website to steal.

Better still, a passkey is tied to the real website's address. If a scammer builds a perfect copy of your bank's site at a different address, your device simply will not offer the passkey there.

How mainstream are they now?

For World Passkey Day in May 2026, the FIDO Alliance, the industry group behind the standard, published a survey of about 11,000 consumers in ten countries. It estimated that around 5 billion passkeys are now in use worldwide. Of the people surveyed, 90 percent said they had heard of passkeys, 75 percent had turned one on for at least one account, and about half said they use them regularly when offered.

The same report showed the job is not finished. A third of consumers said they had had an account compromised or received a breach notice in the past year, and 57 percent of organisations still relied on methods that can be phished for their staff's main daily sign-in. The FIDO Alliance itself described the next challenge as turning passkeys from something people have switched on into something they use every day.

These are survey figures from the industry body that promotes passkeys, so treat them as a guide to the direction of travel rather than an exact count.

What it means for you

• Fewer passwords to remember. Big services such as email providers, shops and social networks increasingly offer passkeys.
• Much stronger protection against phishing. Even a convincing fake site cannot use your passkey.
• Your face or fingerprint stays on your device. It only unlocks the passkey locally. The website never receives it.
• Passkeys can sync. Apple, Google and many password managers can copy your passkeys securely to your other devices, so a new phone does not lock you out.

Things to watch: not every site supports passkeys yet, and some still keep a password as a back-up, so that password still needs to be strong. Make sure your phone or password manager account itself is well protected, and set up recovery options before you need them.

Try this: create your first passkey

1. Pick an account you use often, such as your main email or a big online shop.
2. Go to its security or sign-in settings and look for Passkeys.
3. Choose Create a passkey and confirm with your face, fingerprint or screen PIN.
4. Sign out, then sign back in using the passkey to see how it feels.
5. Keep your old password strong and unique for now. Our password checker shows how strong it is.

Tip: Want the technical version? Our notes on strong passwords and MFA and cryptography explain public and private keys in more depth.