Passwords Are Losing, and the Numbers Finally Prove It

A new report highlights the growing adoption of passwordless authentication, known as passkeys. Conducted by the FIDO Alliance, a leading industry group, the research involved over 11,000 consumers and 1,400 enterprise decision-makers across ten countries. The findings reveal that passkeys have a significantly higher success rate in sign-ins, at 93%, compared to the 63% success rate of traditional passwords.

Additionally, the average time to sign-in is reduced to approximately 8.5 seconds for passkeys, as opposed to over 30 seconds for password-based logins.

Notably, awareness of passkeys has surged to 90% among consumers, and there are currently around 5 billion active passkeys worldwide. However, despite these promising statistics, the adoption of passkeys remains limited. Even among organizations that have implemented passkeys, many continue to use passwords as a backup option. Furthermore, a significant number of individual users have not adopted passkeys, even when given the choice.

The main obstacle to wider adoption is habit rather than awareness. People tend to stick with familiar methods, even when a safer alternative is readily available. The report suggests that individuals should prioritize securing their most important accounts, starting with their email account, which often serves as a recovery path for other accounts. Setting up a passkey where it is offered is recommended as a proactive step toward enhancing online security.

While passkeys are not entirely foolproof, they offer a robust defense against phishing attacks, which are the primary cause of account compromise today. Nonetheless, it is important to note that device loss and account-recovery processes are still areas that require further security research.

The report emphasizes that major platforms such as Google, Apple, Microsoft, along with numerous banks and retailers, now provide passkeys as a login option, typically found under account security settings labeled "passkey" or "sign in without a password." The immediate action recommended by the report is for users to set up passkeys on their most critical accounts to enhance their security posture.