Passkeys were pitched as the technology that would finally kill the password: no more reused credentials, no more phishing pages that steal a typed-in password, just a cryptographic key pair tied to your device and unlocked with a fingerprint or face scan. Apple, Google, and Microsoft all support them. So why do most of us still type a password most days?

What a passkey actually is

A passkey is a public/private key pair generated on your device. The private key never leaves your device (or your password manager’s encrypted sync); the public key is registered with the website. Logging in means proving you hold the private key, typically via your device’s biometric unlock. There’s no shared secret for a phishing site or a data breach to steal.

The adoption reality

Support is broad — most major platforms and a growing list of large websites accept passkeys. Actual usage is a different story. Passkeys usually sit as an option alongside passwords rather than a replacement, and most users, when given a choice, stick with the login method they already know. Getting a user to actively opt into a new credential type, even a strictly better one, has proven to be a slow, deliberate process.

What’s actually driving adoption

The sites seeing real passkey uptake are the ones that make it the default path rather than an opt-in buried in account settings — auto-prompting eligible users at login rather than waiting for them to go looking for it. Cross-device syncing (so a passkey created on your phone works on your laptop) has also mattered a lot, since early passkey implementations that were tied to a single device felt more like a downgrade than an upgrade.

Where this leaves things

Passwords aren’t disappearing this year or next. But the direction is clear: every major platform is now investing in passkeys as the long-term default, and the sites that stop treating them as an afterthought are the ones seeing real numbers move. The technology problem is largely solved — what’s left is a habits problem.