Passkey Index 2026: a third of sign-ins without a password, and a rubric to get there

On 15 October 2026, as its Authenticate conference opened, the FIDO Alliance published the second edition of its Passkey Index and revised its global estimate: around 7 billion passkeys are now in use, up from the 5 billion announced in May. Behind the headline number, the value of the report lies elsewhere: fifteen major consumer services, including banks, messaging apps, telecom operators and payment platforms, shared their real sign-in data. For a product team, it is the first time the promise of passkeys can be compared with what they deliver at scale.

What the numbers say

• More than one successful sign-in in three uses a passkey: 36% on average across participants, up from 26% in the 2025 edition.
• Passkeys succeed more often: 93% of attempts succeed, against 78% for passwords and traditional multi-factor authentication, SMS codes included. They are nearly three times faster and save 27 seconds per sign-in on average.
• Eligibility is almost universal: 90% of active accounts can create a passkey, and 42% of eligible accounts have one, roughly 38% of all accounts.
• The gap between enrolment and use is closing: 38% of accounts equipped for 36% of sign-ins, against 34% and 26% last year.
• The security benefit is finally measured: all eight participants that track phishing report fewer successful attacks since deployment, and the four that shared cost data see their SMS code bill falling.
• The next step is already planned: nine participants out of thirteen intend to offer accounts with no password at all within twelve months.

The FIDO Alliance states the limits itself: averages are unweighted, so a small service counts as much as a global platform, and the panel grew from nine to fifteen participants, which makes the comparison with 2025 directional rather than strict. The orders of magnitude, however, all point the same way.

The real obstacle is no longer technical

The report names a precise cause for the gap between equipped accounts and actual sign-ins: two participants acknowledge that their flow still offers the password or a code before the passkey, even to users who have one. In other words, the technology is in place, browsers and operating systems support it, but the sign-in screen keeps pushing the old method. Yet the security gain of a passkey vanishes as long as a phishable password is still accepted on the same account. This is a flow design matter, therefore a product decision, not an infrastructure project.

The FIDO rubric: four levels for self-assessment

To help teams cross that line, the FIDO Alliance is publishing on Passkey Central a rubric with four cumulative tiers. It is a self-assessment tool, not a certification.

• Bronze, the functional floor: several passkeys allowed per account to prevent lockouts, a visible management screen, explicit fallbacks and consistent wording.
• Silver, the recommended launch target: autofill in the sign-in field, well-timed prompts to create a passkey, error handling and accessibility.
• Gold: automatic upgrade of a saved password to a passkey after a successful sign-in, with a notification, Signal API integration to remove passkeys that are no longer valid, and account recovery proportionate to risk.
• Platinum: retiring phishable factors, passwords and SMS codes, and alignment across the different domains of the same brand.

The rubric also lists common mistakes: the blocking modal that forces passkey creation, the one-passkey-per-account limit, or silent upgrades without telling the user.

Who is concerned

Any service that authenticates people: customer portal, member area, internal business application, SaaS tool. Decision-makers will find a quantified argument on SMS costs and fraud; product teams, a readable roadmap; security teams, field evidence of phishing resistance. Organisations rolling out passkeys for their employees now have a dedicated section on Passkey Central, with a deployment guide and documented case studies.

Where to start

1. Measure three indicators: share of eligible accounts, share of equipped accounts, share of successful sign-ins by passkey. Without these figures, no decision can be defended.
2. Place yourself on the rubric. The two gaps the rubric itself flags as the most common are the one-passkey-per-account limit and the absence of a management screen.
3. Make the passkey the default path for those who have one, using the browser’s autofill. That is where the gap between 38% and 36% is decided.
4. Prepare the passwordless account for the populations that are ready, starting with high-risk accounts, and define recovery before removing the fallback.
5. Budget the SMS reduction: it is often the line that pays for the project.

We support product and technical teams through this assessment and through flow design, from the bronze floor to the passwordless account. Let’s talk about your sign-in flow.