FIDO Alliance's 7 May 2026 release puts the number of passkeys in use at about 5 billion. That is an estimate, not a count: the alliance combines public data with its own internal data. The release also reports results from its State of Passkeys 2026 survey. So what do passkeys replace? The short answer is the password on sites that support them. The longer answer depends on the site.
What changed in May 2026
The survey was conducted by Sapio Research in April 2026 with 11,000 consumers and 1,400 enterprise decision-makers across ten countries. According to the release, 90% of consumers were aware of passkeys, 75% had enabled one on at least one account, and 49% used passkeys regularly when available. That last figure comes from one sponsored survey, and the excerpts available to us do not explain how 'regularly' was defined.
The enterprise picture is less encouraging. FIDO says 57% of organisations still rely on password-based methods for employees' primary day-to-day sign-in. A syndicated copy of the release describes the same 57% as 'phishable authentication methods', so the alliance's own wording is the one to use.
What is new is the release and its numbers. The underlying technology is not new. Passkeys are built on the FIDO2 and WebAuthn standards.
What do passkeys replace, and what they don't
A password is a shared secret. You remember it, type it, and the site checks it against a stored value. A passkey is a credential kept on your device and unlocked with biometrics, a PIN or something similar, as FIDO describes it. At registration the device creates a key pair. The private key stays on the device, and the site keeps only the public key. At sign-in the site sends a one-time challenge, the device signs it after you unlock it locally, and the site verifies the signature. Apple's support documentation describes this public-key basis for its own implementation.
Because the site holds no reusable secret, a passkey removes the password from the login. A breach of a server that stores only public keys does not expose a login secret that an attacker can reuse.
The password
On a supporting site, a passkey can be the main sign-in factor on its own. FIDO says passkeys can stand alone in this role, so no password is needed for everyday sign-in.
The SMS or app code
The more precise answer is the password-plus-code combination. FIDO says passkeys can replace legacy multi-factor flows such as a password followed by an SMS code. That is not the same as removing every second step on every site. Some sites will still ask for a password or a code, and from the outside you cannot tell which ones have dropped the code. Check the sign-in screens of the services you use.
Why passkeys are called phishing-resistant
A passkey is bound to the domain it was created for. The browser or operating system offers it only where it belongs, so a look-alike site does not receive it. SMS codes, one-time passwords and push approvals work differently. A user can type a code into a fake page or approve a prompt an attacker triggered. Passkey Central's prevention guide draws this distinction.
'Cannot be phished' is a vendor position. 'Phishing-resistant' is the more defensible description. Netcraft, a security firm, reports phishing sites that display passkey options, reportedly by copying the legitimate page's WebAuthn references. Netcraft also warns that removing a user's fallback sign-in can hinder adoption.
The limit is evidence. We found no independent field data comparing real phishing losses between passkey users and password users. The strength of the claim rests on design analysis.
Recovery and device loss: where passwords come back
This is the main caveat. A passkey lives on a device, so losing the phone or laptop can mean losing the credential unless you have another way back in. Auth0, which sells authentication products, lists device-loss recovery as a liability of passkeys. A 2026 analysis reported by StartWithIdentity says recovery typically falls back to passwords or knowledge-based checks, which reintroduces the weakness passkeys were meant to remove. That finding rests on a single secondary source.
Check each service's recovery options before you need them. If the only fallback is a password you have stopped using, a lost device may leave you locked out or pushed back onto the weaker method.
Syncing across devices and platforms
Passkeys come in two broad forms. Synced passkeys are kept by the platform provider and carried across your devices. Device-bound keys stay on one device. Thales distinguishes the two and names hardware security keys as one device-bound option. Device-bound keys are stricter, but they are less convenient when you switch hardware.
Cross-platform use adds friction. StartWithIdentity reports that a passkey created on an iPhone may be hard to use on a Windows PC, and that cross-device QR or Bluetooth flows work but add steps. This is also a single-source finding.
What to do now
Turn on passkeys where a service offers them, and keep a working recovery route. Before you remove a password or a code from an account, confirm you can still sign in from a new device. We did not find a complete, current list of services that still force a password, so you will need to check each important account yourself.
Adoption is uneven. A preprint census of top sites measures whether sites offer passkeys, not whether users choose them. Descope, a vendor, reports organisations adding passkeys in a few places while passwords remain the default elsewhere. Passkeys can replace the password on sites that adopt them. Whether your sites have done so is a question to answer account by account.