Passkeys are now routine, but passwords remain the back door: steps toward passwordless sign-in

On 15 October 2026, the FIDO Alliance released its Passkey Index 2026. The headline finding: passkeys have moved past being "available" and into routine use. On average, 36% of successful sign-ins at participating companies now use a passkey, up from roughly 26% in last year's Index. The participants are not small names: they include Amazon, Google, Microsoft, PayPal, Shopify, TikTok, WhatsApp, Mercari and JP Morgan Chase.

Two days earlier, Dashlane published its Passkey Power 20 report with a sharper message. Even at the domain with the highest passkey usage it measures, Google, only 28% of sign-ins use a passkey. In other words, roughly seven in ten sign-ins still go through older methods. Dashlane's conclusion: supporting passkeys is no longer a differentiator. What sets services apart is the willingness to make passkeys the main path.

For digital businesses this is not just a security team concern. Sign-in is the front door to checkout, balances and customer data. Every failed sign-in is a customer who might walk away.

What a passkey is, briefly

A passkey is a digital credential, built on FIDO and W3C standards, that replaces the password. When a user creates a passkey, their device generates a key pair. According to Google's developer documentation, the server only stores the public key, so data stolen from the server is far less valuable to an attacker. Users simply unlock their device with a fingerprint, face or PIN. Biometric data never leaves the device.

Most importantly, a passkey is bound to the identity of the site or app that created it. The browser and operating system ensure it can only be used on the genuine site. That means users cannot be "tricked" into handing a passkey to a fake site, which is exactly what keeps happening with passwords and one-time codes.

What the latest data says

The Passkey Index 2026 draws on data from 15 consumer companies, compiled on 21 September 2026. The figures are averages across participants, so read them as a direction of travel rather than a precise benchmark for any single business. The most relevant findings:

• Sign-ins succeed more often. Passkey sign-ins succeed 93% of the time, compared with 78% for passwords and traditional MFA such as SMS OTP or authenticator apps.
• They are faster. Passkey sign-in is on average 2.8 times faster and saves about 27 seconds per sign-in, according to the nine participants that measured it.
• Phishing falls. Eight out of eight participants that measure phishing report fewer successful phishing attacks since deploying passkeys.
• SMS OTP costs fall. All four participants that shared savings data report lower SMS OTP costs, with annual savings ranging from about USD 1 million to hundreds of millions of dollars, depending on scale.
• Flow design matters. Two participants admit their sign-in flow still shows a password or OTP before offering the passkey, even to users who already have one. One of them estimates that offering the passkey first would roughly double its passkey sign-in share.

Nine of the 13 participants that answered plan to offer passwordless accounts within the next 12 months.

Dashlane's data shows the same pattern from the user side. Passkey authentications by Dashlane users reached 2.5 million a month, nearly double last year, and 57% of its users now store at least one passkey. Growth is fastest at services that hold money or sensitive data: finance, payments, private healthcare, and HR and payroll platforms.

The problem is not the technology, it is the back door

Dashlane notes that none of the ten leading domains requires passkeys. They rely on persuasion: putting passkeys where people can see them, selling the speed benefit, and gradually removing weaker methods such as one-time codes. That works, but it has a ceiling.

As long as passwords and SMS OTP remain available as fallbacks, attackers will choose those routes. Dashlane puts it plainly: a passkey offered alongside a password removes very little risk, while a passkey that replaces one removes a great deal.

The old worry about being locked into one ecosystem is also being addressed. According to Dashlane, iOS 26 supports moving passkeys between Apple Passwords and third-party credential managers through Credential Exchange, and Google Password Manager on Android followed in 2026.

There is also a new angle: AI agents. As agents start to carry out transactions on behalf of users, businesses need to know who authorised them. FIDO Alliance CEO Andrew Shikiar, quoted by Dashlane, describes phishing-resistant open standards as the way to give users, merchants and banks confidence in agent-led transactions. We have covered another side of this topic: access limits for AI agents.

What it means for businesses in Indonesia

Many apps in Indonesia, from e-commerce and fintech to retail loyalty apps, still depend on passwords plus OTP delivered by SMS or WhatsApp. OTP codes can be talked out of customers through social engineering, the cost runs per message, and failed deliveries make customers give up on signing in. Passkeys do not solve everything, but they close one of the most frequently exploited gaps.

Six practical steps to start with:

1. Measure your sign-in flow today. Record sign-in success rate, OTP volume and monthly cost, password reset tickets, and account takeover cases. Without a baseline you cannot prove the result. OTP spend also needs a clear budget owner, as we discussed in FinOps for organisations.
2. Start with the most valuable accounts. Accounts holding balances or payment methods, merchant accounts, and internal admin panels. That is where phishing does the most damage.
3. Make the passkey the first path, not a hidden menu. Offer passkey creation right after a successful sign-in or transaction, and show the passkey before the password for users who already have one. The FIDO data shows that display order alone can make a big difference.
4. Take account recovery seriously. If "lost my passkey" ends in SMS OTP alone, attackers will simply target recovery. Define extra verification for recovery and for changes to sensitive data such as phone numbers or payout accounts.
5. Remove fallbacks step by step. For example, passwordless sign-up for new accounts, OTP only for users without a passkey, then monitor the effect on support tickets and conversion.
6. Do not forget employee accounts. FIDO's State of Passkeys 2026 report found that 57% of organisations still rely on passwords as the primary way employees sign in. Cloud consoles, code repositories and HR systems deserve priority.

How MarkasDev helps

MarkasDev works as a Technology Partner for operational reliability, in three phases:

• Diagnose: map your sign-in and recovery flows, OTP costs, failure points and the fallbacks attackers can still use, then set priorities.
• Deliver: implement passkeys on web and mobile apps, rework recovery flows and add measurement, with written milestones and acceptance criteria.
• Operate: a retainer with SLA and monitoring, including sign-in success rates, OTP costs and account takeover anomalies. We explain how this differs from fixing things when they break in Maintenance vs Operate.

If sign-in and OTP are still a source of customer complaints or rising costs, book a Diagnose session to map your path to passwordless sign-in.

Sources

• FIDO Alliance, "Passkey Index 2026" (15 October 2026): https://fidoalliance.org/passkey-index-2026/
• FIDO Alliance, "Passkey Index October 2026" (full PDF): https://fidoalliance.org/wp-content/uploads/2026/10/Passkey-Index-October-2026.pdf
• Dashlane, "The 2026 Dashlane Passkey Power 20" (13 October 2026): https://www.dashlane.com/blog/passkey-report-2026
• FIDO Alliance, "Five Billion Passkeys: A Milestone, Not a Finish Line" (7 May 2026): https://fidoalliance.org/five-billion-passkeys-a-milestone-not-a-finish-line/
• Google for Developers, "Passkeys" (updated 1 October 2026): https://developers.google.com/identity/passkeys