One sign-in in three at some of the biggest consumer services now happens with a passkey. That is the headline of the FIDO Alliance's Passkey Index, published on 15 October 2026. The useful part is not the headline. It is what the Index measures, what it leaves out, and what both mean for the accounts you actually care about.
The short answer: move your main accounts to passkeys now, but set them up in the right order and keep one backup that is not a text message. The numbers below explain why.
What the Index measured
The Index pools sign-in data from 15 consumer services, up from nine last year, among them Amazon, Google, Microsoft, PayPal, TikTok and WhatsApp. It counts successful sign-ins, includes re-authentication and leaves out account recovery. The figures are unweighted averages, so a small service counts as much as a giant one. FIDO itself calls the year-on-year comparison directional, because the group of services changed. Read the Index summary or the full report.
The numbers that matter
| Measure | 2026 figure | What it means for you |
|---|---|---|
| Successful sign-ins made with a passkey | 36%, up from 26% in 2025 | On services that offer them, passkeys are now ordinary, not experimental |
| Success rate, passkey vs traditional MFA | 93% vs 78% | A passkey attempt fails about one time in fourteen; a password plus a code fails about one in five |
| Time saved per sign-in | About 27 seconds, "nearly three times faster" | Minutes a week, on devices you unlock dozens of times a day |
| Accounts with a passkey enrolled | 38% | Only two points above usage, so people who enroll do keep using them |
| Passkeys in use worldwide | FIDO estimate of 7 billion | No counting method is published; treat it as a slogan, not a measurement |
The 78% baseline is passwords plus traditional second factors such as text-message codes and authenticator apps, taken from the report's comparison table. The gap is mostly about typing: a code can be mistyped, delayed or sent to an old number. A passkey is a tap and a face or fingerprint.
The two-point gap is the real story
Enrollment sits at 38% and usage at 36%. Eight of the ten services that report both figures show usage trailing enrollment. The pattern is familiar: a service nudges you to create a passkey on your phone, and the next week you sign in from a laptop where that passkey does not exist. The service falls back to a password and a code.
That fallback is where your risk lives. A passkey cannot be phished, because there is nothing to type into a fake page. A text-message reset can be. So the question is not whether to create a passkey. It is whether your fallback is as strong as the passkey it protects.
A ten-minute setup, in the right order
- Start with the email account that recovers everything else: Google, Apple or Microsoft. If that account is safe, the rest can be rebuilt.
- Create the passkey on a device you own. Google's own guidance is blunt: anyone who can unlock the device can open the account, so never create one on a shared or work machine. Google's passkey page has the steps.
- Turn on syncing. On Apple devices that is iCloud Keychain, which Apple describes as end-to-end encrypted with keys it does not hold; passkeys then survive the loss of a single device. On Android, a passkey registered to your Google Account travels with it. Apple's security note explains the recovery path.
- Add a second passkey the same day, on another device or a hardware security key. This is the step most people skip.
- Replace the text-message fallback wherever the service allows, and keep the recovery codes somewhere offline.
- Then do banking, shopping and social accounts, in that order of damage if lost.
If the phone goes missing: Apple lets you recover the keychain through escrow, with ten attempts before the record is destroyed. Google lets you sign in from another device and remove the lost device's passkey under "Passkeys and security keys". We walked through both paths in our guide to losing the phone that holds your passkeys.
Frequently asked questions
Is a passkey safer than a password plus an authenticator app?
Against phishing, yes, because there is nothing to type. The 93% versus 78% figure is about sign-ins succeeding, not about safety; the safety case rests on the design, not the Index.
Should I delete my password once I have a passkey?
Only where the service offers a passkey-only mode. Most still keep the password as a fallback, so make it long, unique and stored in a password manager.
Why does my bank not offer one yet?
The Index covers consumer technology services, which moved first. Banks are slower and often use their own app as the second factor. Ask; several now support passkeys quietly.
Does this change anything if I already use a hardware key?
No. A hardware key is a passkey that does not sync, which is a feature for high-value accounts. Keep a second one registered. The security keys we covered in our 2019 series on strong authentication are the ancestors of today's passkeys.
Conversation
Have a question or correction? Contact Rvasus.