The password's failure has been declared for twenty years, but declarations are not adoption. What changed is that passkeys removed the two obstacles that killed every predecessor: they required no new hardware for consumers, because the phone in everyone's pocket became the authenticator, and they required no new behavior, because unlocking with a face or fingerprint is easier than typing a password.
The FIDO Alliance, whose members built the underlying standards, now counts billions of accounts enabled for passkey sign-in across the largest consumer platforms. More telling than the cumulative number is the shift in posture: services that once offered passkeys as an opt-in security feature increasingly present them as the default path at sign-up.
Why it matters
Phishing remains the single most productive attack in the criminal economy because passwords are shared secrets: type yours into a convincing fake page and it is gone. Passkeys break that mechanism cryptographically. The credential is a key pair, the private half never leaves the device, and the browser or operating system will only use it for the exact domain that registered it. A perfect replica of a login page hosted at the wrong domain simply receives nothing.
That same property defeats credential stuffing — the reuse of passwords leaked from one breach against other services — since there is no reusable secret to leak. For defenders, passkeys are one of the rare security improvements that reduces both user effort and attacker success at the same time.
How it works
When a user creates a passkey, the device generates a public-private key pair; the service stores only the public key. At sign-in, the service issues a challenge, the device signs it after a local biometric or PIN check, and the signature proves possession without transmitting anything an eavesdropper could reuse. Synced passkeys replicate the credential across a user's devices through the platform's encrypted cloud keychain, while device-bound passkeys stay on one piece of hardware — a distinction that matters for regulated environments.
Cross-device sign-in handles the mixed case: a user can log in on a laptop by approving a prompt on their phone over Bluetooth proximity, with no password typed anywhere.
Evidence
The FIDO Alliance publishes adoption figures and deployment case studies, including large-scale rollouts reporting drops in phishing-driven account takeover after passkey enablement. Google documented its move to make passkeys the default sign-in option for personal accounts. CISA has publicly encouraged phishing-resistant authentication, naming FIDO2 and passkeys among the approaches that meet that bar, in its guidance and in the government's zero-trust direction under OMB M-22-09.
The competing read
Passkeys solve the theft problem and create a recovery problem. Lose every device holding the credential and account recovery falls back to whatever weaker path the service still offers — often the same email-and-SMS chain passkeys were meant to replace, which attackers then target instead. Portability is the other open wound: moving credentials between Apple, Google and password-manager ecosystems is still clumsier than it should be, and critics note that platform-controlled sync tightens the platform lock-in the standards were supposed to loosen.
Enterprises face their own version: managed fleets need attestation, policy controls and revocation semantics that consumer passkey flows only partially provide, which is why workforce deployments lag consumer ones.
What happens next
Three developments will decide whether passkeys finish the job. The FIDO Alliance's credential-exchange work, which aims to make moving passkeys between providers safe and standard, is the one to watch for portability. Enterprise attestation features will determine workforce adoption. And on the attacker side, expect adversary-in-the-middle phishing kits to keep evolving toward session-token theft — which bypasses authentication strength entirely and is already the counter-move of choice.