1. The Password Problem Is Getting Harder to Ignore
Passwords remain one of the most familiar parts of modern technology, yet they are also one of its persistent security weaknesses.
People are expected to create unique credentials for dozens or even hundreds of online accounts. They must remember which password belongs to which service, update compromised credentials and avoid reusing the same combination across multiple platforms.
In practice, many users struggle to maintain these habits. Weak passwords, reused credentials and convincing phishing messages can give criminals opportunities to access email accounts, financial services, social media profiles and corporate systems.
The consequences extend beyond individual inconvenience. A compromised email account can help an attacker reset passwords elsewhere, while stolen credentials can be used in automated attacks against other services.
The scale of the problem remains significant. In its 2026 consumer research, the FIDO Alliance reported that 33% of surveyed people had experienced an account compromise or received a breach notification during the previous year. The survey covered 11,000 consumers across ten countries. [1]
These findings do not mean every incident was caused by a password, but they illustrate the continuing burden of account security.
The technology industry increasingly recognises that asking people to create ever more complicated passwords is not a complete solution. Instead, companies are developing authentication systems that reduce reliance on passwords altogether.
Passkeys are emerging as one of the most promising alternatives.
2. What Exactly Is a Passkey?
A passkey is a digital credential that allows someone to sign in without typing a conventional password.
Depending on the device and service, authentication may involve a fingerprint, facial recognition, a device PIN or another local verification method. The user approves the sign-in, and the device uses cryptographic technology to prove that the account holder possesses the appropriate credential.
The underlying technology is different from a password manager simply filling in a stored password.
Passkeys use public-key cryptography. When a passkey is created, a related pair of cryptographic keys is generated. The private key is retained by the user's device or credential-management system, while the corresponding public key is registered with the website or application.
During sign-in, the service sends a cryptographic challenge. The user's device uses the private key to respond, and the service verifies the response using the public key. The private key itself is not sent to the website. [2]
This design changes the security equation.
With a conventional password, an attacker who obtains the credential may be able to reuse it elsewhere if the victim has recycled it. With a properly implemented passkey, stealing a database containing public keys does not give an attacker the private keys required to authenticate.
Passkeys are also designed to be bound to the legitimate website or application. A passkey registered for one service cannot simply be used to sign in to a convincing imitation of that service.
That makes passkeys particularly valuable against phishing, where criminals trick people into entering credentials on fraudulent websites.
However, passkeys do not make every form of cybercrime impossible. Malware, compromised devices, stolen sessions, fraudulent recovery processes and social engineering can still threaten accounts. Their advantage is that they remove several common weaknesses associated with passwords.
3. Passkeys Are Moving Into the Mainstream
The shift away from passwords is no longer just a technology experiment.
According to the FIDO Alliance's Passkey Index, published on 15 October 2026, passkeys accounted for 36% of successful sign-ins across the 15 major consumer services included in its analysis. That was up from approximately 26% in 2025. [1]
The same report found that passkey sign-ins had a 93% success rate, compared with 78% for traditional multi-factor authentication sign-ins in the measured data. Passkey sign-ins were also nearly three times faster, saving an average of 27 seconds per sign-in.
These results suggest that passkeys can offer more than improved security. They can also reduce the friction associated with logging in, recovering forgotten passwords and entering additional verification codes.
The FIDO Alliance reported an estimated seven billion passkeys in use worldwide in October 2026. This is an industry estimate rather than a count of seven billion unique people, and the number of credentials should not be confused with the number of active users. [3]
Nevertheless, the direction is clear: passkeys are increasingly being incorporated into widely used digital services.
Major technology companies have helped drive adoption by supporting passkeys across operating systems, browsers and account platforms. Financial services, online retailers and other consumer-facing businesses are also exploring the technology as a way to make account access both simpler and more resistant to phishing.
The next challenge is no longer just making passkeys available. It is persuading more people to use them consistently and ensuring that the systems surrounding them are secure.
4. Why Governments Are Taking Passkeys Seriously
Passkeys are attracting attention beyond the private technology sector.
On 14 September 2026, the UK government announced that passkeys were being rolled out across GOV.UK One Login, which serves more than 23 million users. The government said passkeys could provide a faster and more secure way to access participating public services, including services related to childcare and driving licences. [4]
The announcement followed an initial trial in which more than 300,000 users successfully switched to passkeys.
This is significant because government authentication systems must balance security, convenience and accessibility across a diverse population. A solution that works only for technologically confident users would be insufficient for a public service used by millions.
Passkeys could help reduce dependence on passwords and verification codes, but the implementation must account for people who lose devices, change phones, share access to technology or cannot use a particular biometric method.
The UK's National Cyber Security Centre has also moved towards recommending passkeys wherever they are available, stating that FIDO2 credentials offer protection against common credential attacks that traditional multi-factor authentication methods may not provide. [5]
That does not mean passwords and other verification methods should immediately disappear from every government service. Public-sector systems must retain secure recovery procedures and alternative access routes for people who need them.
The broader message is that phishing-resistant authentication is becoming an important part of modern digital security.
5. Can Passkeys Stop Phishing and Account Takeovers?
Phishing remains a major problem because it targets human behaviour rather than relying exclusively on technical weaknesses.
A criminal might send a message claiming that a bank account has been suspended, that a parcel cannot be delivered or that an employee must urgently review a document. The victim is directed to a fraudulent website designed to capture their login credentials.
Traditional multi-factor authentication can reduce the risk of account compromise, but some methods remain vulnerable to sophisticated phishing. For example, an attacker may trick a victim into entering a password and a one-time verification code on a fraudulent site in real time.
Passkeys approach the problem differently.
Because the cryptographic authentication process is linked to the legitimate website or application, a passkey created for the real service will not ordinarily authenticate the user on an unrelated phishing domain. The user does not have to recognise a fake login page and decide whether to type their password.
The National Cyber Security Centre's 2026 assessment concluded that FIDO2 credentials, including passkeys, are as secure as or more secure than traditional multi-factor authentication against the common credential attacks examined in its analysis. [5]
For businesses, this could reduce the likelihood that stolen credentials become the entry point for an attack.
For consumers, it could mean fewer situations in which a single deceptive message leads to an account takeover.
However, the protection depends on implementation. Attackers may still target users through fraudulent account recovery requests, malicious software, stolen devices or techniques that persuade victims to approve actions they do not understand.
Passkeys reduce a significant category of risk, but they do not eliminate the need for security awareness and sensible account management.
6. The Business Case: Security Could Become Cheaper and Simpler
The benefits of passkeys extend beyond protecting individual accounts.
Businesses spend resources on password resets, account recovery, support requests, identity verification and investigating suspicious login activity. Password-related problems can also interrupt purchases, delay employees and create frustration for customers.
A passkey system can reduce some of these costs by allowing users to authenticate without memorising or repeatedly resetting passwords.
The FIDO Alliance's 2026 research found that 47% of surveyed consumers said they were likely to abandon a purchase or sign-in when they could not remember their password. [1]
That creates a commercial incentive for businesses to improve the login experience. A customer who can authenticate quickly may be less likely to abandon an online purchase because of a forgotten password.
The same logic applies to employees. If workers spend less time dealing with login problems, they may have more time to focus on their actual responsibilities.
The FIDO Alliance's research also found that 68% of surveyed organisations had deployed or were actively deploying passkeys for employee sign-ins. [6]
These results indicate that passkeys are becoming relevant to both consumer services and corporate IT.
Nevertheless, adoption requires investment. Companies must integrate the technology into existing systems, train support teams, develop recovery processes and ensure that older applications can still be accessed securely.
The financial benefits will depend on the organisation's existing password-related costs and how effectively the new authentication system is implemented.
7. What Happens If You Lose Your Phone?
One of the biggest questions surrounding passkeys is what happens when a user loses the device associated with their credentials.
With a conventional password, someone can often sign in from another device by remembering the password or resetting it through an email address. Passkeys require a different approach because access depends on the credential stored on a device or managed through a supported credential provider.
Some passkeys can be synchronised securely across a user's devices through an account-based credential manager. Others are tied more closely to a particular device or security key.
If a phone is lost, a user may be able to access their passkeys from another synchronised device or restore access through the provider's recovery process. But the exact options depend on the service, device and configuration.
This creates a responsibility for companies to design recovery procedures that are secure without being unnecessarily difficult.
If recovery is too restrictive, legitimate users may lose access to important accounts. If it is too permissive, criminals may exploit the recovery process to bypass the protection offered by passkeys.
For example, an attacker who can persuade a support team to transfer an account to a new device may undermine an otherwise strong authentication system.
Users should therefore keep their device accounts secure, maintain appropriate recovery options and understand how to regain access before they need to do so.
Passkeys can improve authentication, but account recovery remains a critical part of the overall security system.
8. Could Big Technology Companies Gain More Control Over Digital Identity?
Passkeys introduce another important question: who controls the credentials that allow people to access their digital lives?
Many users rely on device manufacturers, operating-system providers or password-management services to store and synchronise their passkeys. This can make the experience convenient, especially when someone owns several devices.
However, it also means that users must understand how their chosen provider manages synchronisation, recovery and account security.
A person who relies heavily on one ecosystem may find it more complicated to move their credentials to another provider or recover them if their main account becomes inaccessible.
The passkey standards are designed to support interoperability, but the practical experience still depends on the platforms and services involved.
This is particularly important for businesses that need employees to access systems across different operating systems and devices.
Organisations must consider whether credentials can be transferred or synchronised safely, how access will be revoked when an employee leaves and what happens if a device is lost or compromised.
The transition to passkeys should not create a new form of dependency that is difficult to manage.
Ideally, users should benefit from strong security while retaining clear choices about the devices and services they trust.
9. Are Passwords Really Going to Disappear?
Despite growing adoption, the immediate disappearance of passwords is unlikely.
Many websites still rely on legacy authentication systems. Some services have not implemented passkeys, while others offer them as an optional alternative alongside conventional passwords.
Different users also have different needs. Some may lack compatible devices, while others may require accessible alternatives or need to use shared computers and specialised workplace systems.
Businesses must also consider older applications, automated processes and systems that were designed around password-based access.
The transition is therefore likely to happen gradually.
During the coming years, more services may make passkeys the preferred sign-in method while retaining alternative options for account recovery and exceptional circumstances.
Passwords could remain available as a fallback even after passkeys become the normal way to authenticate.
There is also a distinction between eliminating passwords from the user's experience and eliminating every password-related mechanism from the underlying technology. Some organisations may continue to maintain legacy credentials behind the scenes while progressively moving users towards stronger authentication.
The likely outcome is not an overnight end to passwords, but a steady reduction in the number of situations where people need to create, remember and type them.
10. How Consumers Can Prepare for a Passwordless Future
Consumers do not need to wait for passwords to disappear before improving their security.
A sensible first step is to check whether important services already support passkeys. Email accounts, financial services and major online platforms are good places to start because access to these accounts can have significant consequences if compromised.
Where passkeys are available, users should consider enabling them through the service's official website or application.
They should also:
Keep their phone, computer, browser and operating system updated.
Protect the account used to synchronise credentials with a strong authentication method.
Review recovery options and ensure they can regain access if a device is lost.
Remove access from old devices that are no longer used or trusted.
Continue to treat unexpected messages, links and requests for sensitive information with caution.
Use a reputable password manager for accounts that still require passwords, and avoid reusing credentials.
Passkeys can reduce exposure to phishing, but good security still depends on the wider account environment.
Consumers should also be cautious about claims that any authentication method makes an account completely immune to hacking. Security is a process involving multiple layers of protection, not a single feature.
11. The Verdict: Passwords Are Losing Their Place, but the Transition Is Not Over
The movement towards passkeys represents one of the most practical changes in everyday cybersecurity.
Instead of relying on secrets that users must remember and criminals can trick them into revealing, passkeys use cryptographic credentials linked to legitimate websites and applications. The approach can make authentication easier while reducing exposure to phishing and stolen-password attacks.
Adoption is accelerating. The FIDO Alliance's October 2026 research found that passkeys accounted for more than one-third of successful sign-ins across the services it measured, while the UK government is expanding their use across public services. [1][4]
These developments suggest that passwordless authentication is moving beyond early experimentation and becoming part of mainstream digital infrastructure.
But passwords will not disappear immediately. Legacy systems, recovery challenges, accessibility requirements and differences between platforms will slow the transition.
The next stage will depend on whether technology companies, banks, governments and businesses can make passkeys easy to adopt without creating new problems around recovery, interoperability or control over digital identity.
For consumers, the direction is encouraging: signing in could become faster and safer without having to remember increasingly complicated strings of characters.
The password may not be dead yet. But its role as the default gateway to the digital world is increasingly under pressure.
Sources
[1] FIDO Alliance, “Passkey Index 2026,” 15 October 2026. https://fidoalliance.org/passkey-index-2026/
[2] Microsoft Support, “Passkeys frequently asked questions (FAQ).” https://support.microsoft.com/en-gb/accounts-billing/security/passkeys-frequently-asked-questions-faq
[3] FIDO Alliance, “7 Billion Passkeys and Counting: The Next Chapter of Passwordless Authentication,” 15 October 2026. https://fidoalliance.org/7-billion-passkeys-and-counting-the-next-chapter-of-passwordless-authentication/
[4] UK Government, “Millions of people to benefit from simpler, more secure way to sign in to government services,” 14 September 2026. https://www.gov.uk/government/news/millions-of-people-to-benefit-from-simpler-more-secure-way-to-sign-in-to-government-services
[5] National Cyber Security Centre, “Passkeys are more secure than traditional ways to log in,” 23 April 2026. https://www.ncsc.gov.uk/blogs/passkeys-are-more-secure-than-traditional-ways-to-log-in
[6] FIDO Alliance, “FIDO Alliance Reports Accelerating Global Passkey Adoption on World Passkey Day 2026,” 7 May 2026. https://fidoalliance.org/fido-alliance-reports-accelerating-global-passkey-adoption-on-world-passkey-day-2026/
Published by Banx Network. This article is part of the Banx decentralized media programme, powered by the BXE token on the XRP Ledger.
