The October update
On 15 October 2026, the FIDO Alliance estimated that seven billion passkeys were in use worldwide. Its accompanying 2026 Passkey Index draws on information from 15 major consumer services.
That is an adoption signal, but it should be read precisely. Seven billion credentials does not mean seven billion different people. A person can hold credentials for multiple services, and observations from participating services should not be presented as measurements of every website or every user.
What a passkey changes
WebAuthn Level 3 describes public-key credentials scoped to a relying party. Rather than asking the user to send a reusable password to the service, the authentication process can demonstrate possession of the appropriate credential.
FIDO's passkey guidance describes passkeys as a phishing-resistant alternative to passwords. Depending on the credential and platform, access can involve a device's screen lock or a security key. A passkey is not a reason to disclose a device PIN to another person or to approve an unexpected sign-in request.
The distinction matters: improving authentication does not automatically make an unlocked device, an email inbox or every account-recovery process safe. Those are separate parts of the account lifecycle.
Ask these questions before switching
For an individual reader, a sensible first step is to inspect the service's own security settings and recovery instructions. Avoid assuming that a feature behaves identically across providers.
Before removing an existing sign-in method, check:
- Which devices or credential providers can access the account?
- What happens if the only available device is lost or replaced?
- Can a second supported credential or recovery method be enrolled?
- How can a missing device or credential be revoked?
- Which fallback methods remain enabled, and how are they protected?
These questions are practical evaluation steps, not a claim that every service supports the same recovery options. Test a replacement sign-in path while you still have access to the account, following the provider's instructions.
What businesses should measure
An organisation planning a rollout can distinguish credentials created from successful, routine use. It can also test accessibility, help-desk recovery and the experience of moving to a new device. The goal should be a usable account lifecycle rather than an impressive enrolment count alone.
The October milestone shows growing adoption in the FIDO ecosystem. It does not justify a guarantee that compromise is impossible, or a universal instruction to delete every password immediately.
Transparency: This explainer was drafted with AI assistance. Primary sources were checked on 29 October 2026. It provides general account-security information; service-specific instructions remain authoritative.