Passkeys Are Replacing Passwords. Here's What That Actually Means.
40% of Google accounts now use passkeys. Here's how passkeys work, why they're better than passwords, and what challenges remain.
The Password Is Finally Dying
In 2026, passkeys crossed a critical adoption threshold: 40% of Google accounts and 35% of Apple accounts now use passkeys as their primary authentication method. Microsoft followed with Windows passkey support across all services. The password — that 60-year-old security relic — is finally on its way out.
A passkey is a cryptographic key pair stored on your device. Instead of typing a password, you authenticate with your fingerprint, face, or device PIN. The private key never leaves your device, so there's nothing to steal in a database breach.
Why This Time Is Different
We've heard "passwords are dead" before. FIDO2 security keys existed for years without mainstream adoption. The difference now is seamless UX: passkeys sync across devices via iCloud Keychain, Google Password Manager, and 1Password. Creating a passkey takes 3 seconds — less than creating a password.
The phishing problem essentially disappears. You can't phish a passkey because there's nothing for the user to type into a fake website. The cryptographic handshake only works with the legitimate domain.
The Remaining Challenges
Account recovery is the big unsolved problem. If you lose all your devices, recovering a passkey-protected account is harder than resetting a password. The industry is working on social recovery and backup mechanisms, but they add complexity to a system whose main selling point is simplicity.