FIDO Passkey Index 2026: passkeys now carry 36% of sign-ins, and FIDO estimates 7 billion in use
The FIDO Alliance's Passkey Index 2026, built on data from 15 consumer services, finds 36% of successful sign-ins use a passkey, up from 26%, with a 93% success rate against 78% for passwords and traditional MFA. FIDO now estimates 7 billion passkeys are in use worldwide.
The FIDO Alliance published its Passkey Index 2026 on October 15, 2026, and alongside it a new estimate that 7 billion passkeys are in use worldwide, up from the five billion it reported in May. The Index pools confidential data from 15 consumer services, among them Amazon, Google, Microsoft, PayPal, TikTok and WhatsApp, against nine in 2025. Its headline: 36% of successful sign-ins now use a passkey, up from 26%, a share that includes re-authentication and excludes account recovery. Passkey sign-ins succeeded 93% of the time versus 78% for passwords and traditional MFA such as SMS OTP, and were 2.8 times faster, saving 27 seconds per sign-in on average. All eight participants that measure phishing reported fewer successful attacks. FIDO calls the year-on-year comparisons directional, since the participant group changed.
Why it matters
The most useful finding is not the 36%, it is the gap behind it. Across participants, 38% of accounts have a passkey but only 36% of sign-ins use one, and 8 of the 10 services reporting both still see usage trail enrollment. Two participants admit their flows offer a password or OTP before the passkey even to users who have one, and one estimates that putting the passkey first would roughly double its passkey sign-in share. If you run a rollout, measure passkey share of sign-ins, not enrollments, and make the passkey the default path for anyone who has one. The enterprise passkey implementation guide covers the flow design.
The phishing result only holds once the fallback goes. A passkey next to a live password is still a phishable account, which is exactly what the BigBear kit exploited. Nine of 13 participants plan passwordless accounts within 12 months, which moves the hard problem to account recovery.
Read the figures with their limits: they are unweighted averages, so a small service counts as much as Amazon, and FIDO gives no counting method for the 7 billion estimate. For single-company numbers, compare Amazon's passkey adoption figures and GOV.UK One Login's rollout.
Source: FIDO Alliance, with the 7 billion estimate from FIDO Alliance
Related on Start with Identity
- BlogIDEMIA pairs passkeys with restricted-use tokens so card networks can let AI agents pay
IDEMIA Secure Transactions launched an Agentic Commerce offering for domestic schemes and private-label issuers that combines passkey cardholder authentication
- BlogEntra ID makes passkeys the default, and retires SMS and voice in 2027
From September 2026 Entra ID auto-enables passkeys for users on SMS or voice. On 1 February 2027 those two methods stop working entirely, for every tenant, with
- BlogGoogle Workspace puts FIDO2 keys into the Windows login, days after Entra makes passkeys default
Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the defa
- PodcastEntra.Chat
A weekly show for Microsoft Entra administrators, with deployment stories from practitioners and the engineers who build the product. Hosted by a Microsoft empl
- PodcastOkta
Okta's 2023 interview series for product managers and marketers on using customer identity to build better experiences. One season, 14 episodes.
- PodcastThe Biometric Update Podcast
A weekly show from trade outlet Biometric Update that explains biometrics and digital identity news to a general audience. Short and accessible.