Skip to content
Start with Identity
Join free
Analysis

Passkey Index 2026: the number to manage is the 2-point gap, not the 36%

FIDO's Passkey Index 2026 says 36% of successful sign-ins at 15 consumer services now use a passkey, and that passkey sign-ins succeed 93% of the time against 78% for passwords and traditional MFA. The finding that should change your rollout plan is smaller: enrolled users still get routed to the password.

By SWI Community TeamOct 19, 2026

The FIDO Alliance's Passkey Index 2026, published October 15, says passkeys now carry 36% of successful sign-ins across 15 consumer services, up from 26% in last year's Index, and that a passkey sign-in succeeds 93% of the time against 78% for passwords and traditional MFA. Those are the figures that will appear in board decks. The one that should change how you run a rollout is quieter: 38% of accounts have a passkey and 36% of sign-ins use one, and 8 of the 10 services that report both still see usage trailing enrollment. The work left is routing, not persuasion.

Key takeaways

  • Measure passkey share of successful sign-ins, not enrollments. The Index shows the two moving at different speeds.
  • The cheapest gain is putting the passkey first for users who already have one. One participant estimates that alone would roughly double its passkey sign-in share.
  • The 93% versus 78% success gap is the business case. It is measured against SMS codes and authenticator apps, not just bare passwords.
  • Phishing reductions hold only when the fallback goes. Nine of 13 participants plan passwordless accounts within 12 months, which makes account recovery the next control to design.
  • Quote the 7 billion global passkey estimate carefully. FIDO publishes no counting method for it.

What the Index actually measured

It is a pooled, confidential survey, not a telemetry feed. Fifteen consumer relying parties contributed, against nine in 2025, and no figure is attributed to any one of them. Results were compiled on September 21, 2026. Every percentage is an unweighted average across the participants that answered, so a regional bank counts as much as the largest marketplace in the group. Not every participant answered every question, and the report notes the sample size on each figure. FIDO itself calls the year-on-year comparisons directional, because the group of companies changed.

None of that makes the numbers wrong. It means they describe what a typical participant sees, not what share of the world's sign-ins use passkeys. Read the full report before you put any of it on a slide; it is eight pages.

Four figures worth planning around

36% of successful sign-ins (n=12). Up 10 points on the 2025 Index. The count includes re-authentication and excludes account recovery, and it covers only services that offer passkeys for sign-in. If your own dashboard counts recovery flows or excludes step-up prompts, your number will not be comparable.

The gap: 38% enrolled, 36% signing in. In 2025 it was 34% against 26%, an 8-point gap. Now it is about 2 points. That sounds solved until you read the next line: 8 of 10 participants still sign users in with something else more often than their enrollment rate would predict. Two of them say plainly that their flow shows a password or one-time code before offering the passkey, even to a user who has one.

93% against 78% success (n=12). Passkeys beat "passwords and traditional MFA such as SMS OTP and authenticator apps" by 15 points, and did better at 11 of 12 participants. Sign-in was also faster at all nine services that measured it, by 2.8 times on average and about 27 seconds per sign-in. FIDO labels the 27 seconds indicative, since each participant measured its own time difference.

8 of 8 saw fewer successful phishing attacks. This is a new question, so there is no prior year. Every participant that measures phishing reported a decrease since deploying passkeys. The sample is small and self-reported, and it is still the first production evidence the Index has collected for the claim everyone already makes.

Figures to stop repeating

"7 billion passkeys." FIDO's announcement states the estimate but not how it was derived, and it is not one of the Index's measured findings. It does not say, for example, whether a passkey synced across five devices counts once or five times. Use it as a sign of direction, never as a denominator.

"Passkeys are 36% of all logins." They are 36% of successful sign-ins, averaged across 12 services that offer them. Your workforce tenant, your bank and your game studio are not in that average.

"Passkeys are three times faster." The report says 2.8 times, measured against signing in without a passkey, at nine services. Quote it as that.

What to change in a rollout this quarter

1. Fix the routing before running another enrollment campaign. If a returning user has a registered passkey on the device, the first thing they should see is the passkey prompt, with the password behind a secondary link. WebAuthn's conditional mediation (passkey autofill in the username field) and identifier-first flows both do this. The Index's own participants are telling you that offering the passkey second leaves roughly half the potential usage on the table.

2. Change the metric you report. Track passkey share of successful sign-ins weekly, split by platform, alongside enrollment. When enrollment climbs and sign-in share does not, the problem is in your flow, your device coverage or your session lifetimes, not in user willingness.

3. Treat the fallback as the attack surface. A passkey sitting next to a working password still leaves the account phishable. That is exactly what the BigBear kit exploited in September by disabling WebAuthn in the victim's session to force a downgrade. The phishing gains the Index reports come from services that stopped offering the weaker path, or at least stopped offering it first. For workforce accounts, our SMS MFA off-ramp analysis covers the sequencing.

4. Design recovery before you remove passwords. Nine of 13 participants plan passwordless accounts in the next 12 months, one more is researching it, and three have no plans in that period. Once the password is gone, account recovery becomes the sign-in method attackers aim at, usually through a help desk or a support chat. Decide now what proof a user without any device has to show, and who is allowed to accept it.

5. Decide your position on synced passkeys. The Index does not split usage between synced passkeys and device-bound ones, so it tells you nothing about which kind is driving the growth. Enterprises that need device-bound keys for privileged roles should say so in policy, and accept that those users will see lower convenience. Our August piece on passkeys' first hard month covers where sync custody and in-session reuse became the weak points.

How this squares with single-company numbers

Single-company disclosures are the cross-check. Amazon reported 175 million customers using passkeys in August, and GOV.UK One Login opened them to its users in September. Those are counts of people, not shares of sign-ins, so they cannot be lined up against the Index directly. Together they say the same thing the Index does: availability is no longer the constraint, and the remaining work is in the sign-in path and the recovery path.

Last reviewed By SWI Community TeamSuggest a correctionHow we research
#passkeys#authentication#standards#analysis
Independent analysis. No vendor sponsorship.