Microsoft now hands new account holders a choice of a passkey, a push notification, or a security key — and quietly drops the password field from the sign-up form entirely. Google, Apple, PayPal, and Chase have each spent 2026 pushing the same option harder than ever. The FIDO Alliance, the industry group that designed the technology, says roughly 5 billion passkeys are now in active use worldwide, and 90 percent of people say they’ve at least heard of them.
None of that means passwords are gone. It means 2026 is the year passkeys stopped being a niche security feature and started being the thing your bank, your email provider, and your favorite shopping app quietly nudge you toward every time you log in. Here’s what actually changed, how safe the technology really is, and what to do about the things that still don’t work perfectly.
Key Takeaways
- A passkey replaces a password with a cryptographic key pair tied to your device and confirmed with your fingerprint, face, or screen lock — there’s no secret string for a criminal to steal or guess.
- The FIDO Alliance reports about 5 billion passkeys in active use in 2026, with 90% consumer awareness and 75% of people having enabled one on at least one account.
- Microsoft says passkey sign-ins succeed 98% of the time, versus 32% for password-based logins, and now makes new accounts passwordless by default.
- Passkeys are phishing-resistant by design — there’s no password to type into a fake login page — but the UK’s National Cyber Security Centre still flags real gaps around device loss, switching between password managers, and shared or older devices.
- Google, Apple, Microsoft, PayPal, and a growing list of banks including Chase and Bank of America now support passkeys, but implementation is inconsistent — some banks let you create one without letting you actually sign in with it yet.
- Security experts generally recommend keeping a password as backup rather than deleting it entirely, at least until account-recovery options mature further.
Table of Contents
- What Is a Passkey, Exactly?
- Why 2026 Is the Year Passkeys Went Mainstream
- Passkeys vs. Passwords vs. Two-Factor Codes
- Are Passkeys Actually Safer?
- The Real Downsides Nobody Mentions
- Which Accounts and Banks Already Support Passkeys
- How to Set Up Your First Passkey
- What Happens If You Lose Your Phone
- FAQ
What Is a Passkey, Exactly?
A passkey is a credential built on the WebAuthn standard, developed through the FIDO Alliance — the same consortium behind the security keys banks and enterprises have used for years. Instead of a word or phrase you type and a server stores, a passkey is a pair of cryptographic keys: a private key that never leaves your device, and a public key that the website or app keeps on file.
When you sign in, the site sends a challenge, your device signs it with the private key using your fingerprint, face scan, or device PIN to unlock it, and the site verifies the signature with the public key it already has. Nothing you type or say is ever transmitted, so there’s no password sitting in a database for a hacker to steal, and no secret to hand over to a convincing fake login page. If a company that stores your passkey’s public key gets breached, that public key is useless to an attacker on its own.
Most passkeys today are “synced” — stored in your phone’s or browser’s cloud keychain (Apple’s iCloud Keychain, Google Password Manager, or a third-party manager like 1Password or Bitwarden) so they carry over automatically when you get a new device. A smaller category, “device-bound” passkeys, stays locked to a single physical device or hardware security key and never syncs anywhere, which some banks and workplaces prefer for extra assurance.
Why 2026 Is the Year Passkeys Went Mainstream
Passkeys have existed since 2022, but three things converged in 2026 to push them from optional feature to default experience.
First, Microsoft made new Microsoft accounts passwordless by default, redesigning its sign-up flow so new users choose a passkey, a push notification, or a security key instead of ever creating a password. Microsoft says it now registers close to a million new passkeys a day among existing users, and that passkey sign-ins succeed 98% of the time compared with 32% for password-based logins — a gap the company attributes to forgotten passwords, typos, and failed resets rather than any single dramatic failure mode. The company also retired its own “World Password Day” branding in favor of “World Passkey Day.”
Second, the FIDO Alliance’s own 2026 research — based on surveys of roughly 11,000 consumers and 1,400 enterprise decision-makers across ten countries — found consumer awareness of passkeys had climbed to 90%, up from 75% the year before, with 75% of people having enabled a passkey on at least one account and 49% using one regularly when it’s offered. On the enterprise side, 68% of organizations reported deploying or actively rolling out passkeys for employee sign-in, though only 28% had achieved a fully passwordless environment.
Third, banks started moving. Retail banking has historically lagged behind Big Tech on authentication upgrades because of stricter regulatory and fraud-liability requirements, but 2026 saw a wave of passkey rollouts among major US banks, alongside new anti-spoofing login layers like Chase’s step that asks for a device PIN in addition to Face ID, aimed at closing a gap where facial recognition can be tricked when someone’s eyes are open but they’re unconscious or incapacitated. Authentication is only one piece of a much bigger shift toward machine-verified identity underpinning everything from banking apps to connected factory systems and Industry 4.0 infrastructure, where cybersecurity has quietly become as foundational as the machinery itself.
Passkeys vs. Passwords vs. Two-Factor Codes
| Method | What you provide | Phishing resistance | Biggest weakness |
|---|---|---|---|
| Password alone | A secret you memorize or store | None — can be typed into a fake site | Reuse, guessing, credential-stuffing, breaches |
| Password + SMS code | A secret plus a one-time text code | Low — codes can be phished or SIM-swapped | SIM-swap attacks, real-time phishing kits |
| Password + authenticator app | A secret plus a time-based code | Moderate — still phishable in real time | User can still be tricked into entering the code |
| Passkey | Your device unlock (biometric or PIN) | High — cryptographically bound to the real site | Device loss, cross-platform migration, recovery flow gaps |
The distinction that matters most is the middle column most people overlook: a passkey is cryptographically bound to the exact website domain it was created for. A fake banking site can display a very convincing copy of your bank’s login page, but it cannot trigger your device to sign in with a passkey created for the real domain — the browser and device simply won’t offer it. That’s a structural difference from a one-time code, which a person can still be tricked into reading aloud or typing into the wrong place.
Are Passkeys Actually Safer?
The evidence so far says yes, with some caveats. FIDO Alliance’s 2026 research found 33% of consumers reported a confirmed account compromise or breach notification in the past year — 41% in the US alone — almost all tied to password-based accounts. Organizations that have rolled out passkeys for employees reported concrete gains: 47% cited improved security posture, 32% saw fewer phishing-related incidents, and 35% saw fewer help-desk password-reset tickets.
The mechanism behind those numbers is straightforward. The most common ways passwords get compromised — reused credentials leaked from an unrelated breach, brute-force guessing, and phishing pages that harvest what you type — simply don’t apply to a passkey, because there’s no shared secret to leak, guess, or harvest. That’s the same underlying principle behind hardware security keys and the family password-hygiene habits worth reinforcing at home, including basic account-security practices every household should already have in place.
What passkeys don’t eliminate is every attack vector. A thief who steals an unlocked phone, or a scammer who talks someone into approving a fraudulent sign-in prompt, can still get in. Weak account-recovery processes — the fallback options a service offers when you lose access to your passkey device — remain a genuine soft spot, and that’s exactly the kind of gap that keeps showing up whenever a company’s authentication system is only as strong as its weakest recovery path, a pattern also visible in broader infrastructure security challenges facing modern data centers.
The Real Downsides Nobody Mentions
The UK’s National Cyber Security Centre (NCSC) has been publicly encouraging passkey adoption while being unusually candid about where the technology still falls short. Its assessment identifies several concrete gaps:
- Inconsistent implementation. Not every service that offers passkeys implements them the same way, which creates confusing, inconsistent experiences across sites.
- Device loss uncertainty. Many users still aren’t clear on exactly how they’d recover account access if their phone were lost, stolen, or destroyed.
- Migration friction. Moving passkeys between different credential managers or ecosystems (say, from an Android phone to an iPhone) isn’t always smooth.
- Accessibility gaps. Shared family or work devices, older hardware, and people for whom biometric authentication doesn’t work reliably are all underserved by the current model.
- Recovery-flow vulnerabilities. Ironically, the account-recovery options built to help you regain access after losing a passkey device can themselves become a target for social-engineering attacks.
None of that is an argument against using passkeys — the NCSC’s own conclusion is a fairly direct “almost definitely yes” when asked whether people should adopt them, since they close off the most common and most damaging attack types. It’s an argument for going in with realistic expectations: check what recovery options a service offers before you rely on a passkey as your only way in, and don’t assume every implementation works as smoothly as the biggest platforms have made it look.
Which Accounts and Banks Already Support Passkeys
| Provider | Passkey support | Notes |
|---|---|---|
| Full — sign-in and account recovery | Offers passkeys as the default suggested method in account settings | |
| Apple | Full — deeply integrated with iCloud Keychain | Passkeys sync automatically across Apple devices |
| Microsoft | Full — passwordless by default for new accounts | Existing accounts can delete stored passwords voluntarily |
| PayPal | Full — sign-in support | One of the earlier major fintech adopters |
| Chase | Partial — passkey login plus added device-PIN step | Extra verification layer added to reduce biometric-spoofing risk |
| Bank of America | Partial — can create a passkey, sign-in support still rolling out | Some users report being able to register but not yet log in with one |
The pattern across banks is worth noting: financial institutions are moving more cautiously than consumer tech platforms, largely because of stricter fraud-liability and regulatory requirements around authentication. If your bank lets you register a passkey but the option to actually sign in with it doesn’t appear yet, that’s a known rollout gap rather than something broken on your end.
How to Set Up Your First Passkey
The exact menu wording varies, but the process is similar across most major platforms.
- Google Account: Go to your Google Account security settings, find “Passkeys and security keys,” and select “Create a passkey.” Confirm with your device’s fingerprint, face unlock, or screen lock.
- Apple ID: On an iPhone or iPad, open Settings, tap your name, then Sign-In & Security, and choose “Set Up a Passkey” under your saved passwords list. It syncs automatically via iCloud Keychain to your other Apple devices.
- Microsoft Account: Visit your Microsoft account security page, select “Advanced security options,” and choose “Add a new way to sign in,” then pick passkey.
- Banking and shopping apps: Look for “passkey,” “biometric sign-in,” or “passwordless login” inside the security or login settings of the app itself — most that support it will prompt you the first time you sign in after a rollout.
A practical starting point: set up passkeys on your email account first, since it’s usually the recovery hub for everything else you own online, then move on to your bank and any account tied to real money.
What Happens If You Lose Your Phone
Because most consumer passkeys are synced through a cloud keychain rather than locked to a single device, losing your phone doesn’t automatically mean losing your accounts. If you sign in to iCloud Keychain, Google Password Manager, or a third-party manager like 1Password or Bitwarden on a replacement device, your passkeys typically reappear once you’re authenticated into that manager.
The catch is that “authenticated into that manager” step. If your cloud account itself is protected only by a password and you’ve forgotten it, or if your phone is lost along with your only two-factor recovery method, you can end up locked out of the very system meant to restore your passkeys — which is exactly the account-recovery weak point the NCSC has flagged. The practical fix is to set up at least one backup recovery method (a secondary email, a printed recovery code, or a second registered device) for your core cloud account before you need it, not after.
FAQ
Should I delete my passwords now that I have a passkey?
Most security guidance, including the NCSC’s, recommends keeping a password as a fallback for now rather than deleting it outright, at least until account-recovery flows across more services mature. Microsoft is the exception that lets you delete stored passwords voluntarily if you’re confident in your recovery setup.
Can someone hack a passkey the way they can guess a password?
Not through guessing or brute force — there’s no secret string to guess. The private key never leaves your device, so an attacker would need physical access to an unlocked device or a way to trick you into approving a fraudulent sign-in request.
Do passkeys work the same way as two-factor authentication?
No. Two-factor authentication adds a second step on top of a password, and that second step (especially an SMS code) can still be phished or intercepted. A passkey replaces the password step entirely and is bound to your device and the real website’s domain, which is why it resists phishing in a way most 2FA codes don’t.
Why does my bank let me create a passkey but not sign in with it?
Some financial institutions are rolling out passkey registration and passkey sign-in as separate phases, often for regulatory or fraud-review reasons. This is a known, temporary gap in several banks’ 2026 rollouts rather than a sign the feature is broken.
What happens if a website that stores my passkey gets hacked?
A data breach at that company would only expose your public key, which is useless to an attacker without the matching private key that stays on your device. That’s a meaningful difference from a password breach, where the leaked password itself can often be reused directly.
The Bottom Line
Passkeys aren’t a future technology anymore — they’re the default sign-in path for new Microsoft accounts, an option on most major platforms, and a feature banks are racing to catch up on through 2026. The security case is strong: no shared secret to steal, no password to phish, and real-world numbers showing fewer account takeovers and fewer failed logins wherever they’ve been rolled out. The rough edges are just as real, though — recovery options vary by service, migration between ecosystems isn’t always seamless, and some banks are further along than others. Set one up on your email account first, keep a backup recovery method in place, and add passkeys to the rest of your accounts as each service catches up.
