Beyond passwords: the passkey shift

Passkeys crossed into the mainstream in 2026 — and for app teams the case is now numbers, not vibes.

Adoption is real: about 5 billion passkeys are in use worldwide, 75% of people have enabled one on at least one account, and 49% use them regularly. That means your users increasingly expect the option — and notice when it's missing.

They perform better on the two metrics that matter for sign-in. Login success runs ~93% with passkeys versus ~63% with passwords, and sign-in takes ~8.5 seconds versus ~31.2 with a typed password + reset detour. Fewer failed logins directly means fewer abandoned sessions at your most fragile funnel step.

And they remove a whole class of risk: passkeys are phishing-resistant by design (the credential is bound to your domain and never leaves the device), and Google reports 99.9% lower account-compromise rates. No shared secret means nothing to leak, phish, or reuse.

The production results back it up: Intuit now handles 85%+ of its mobile authentications with passkeys, and Air New Zealand cut login-abandonment 50% after rollout, with ~30% opt-in in the first 24 hours.

How to roll them out without breaking anyone:

- Offer passkeys as the default for new sign-ups, but keep password/OTP as a fallback for older or shared devices. - Prompt to upgrade at a natural moment (right after a successful login), not with a modal on launch. - Use platform APIs (Passkeys / WebAuthn, Credential Manager on Android, AuthenticationServices on iOS) and sync via the platform keychain so users aren't locked to one device. - Expect fewer 'forgot password' tickets — measure it, it's a real support cost saving.