4 MIN READ
Passkeys have spent five years as the next big thing in identity. By mid-2026, the next big thing sits as the default on the major consumer apps. Google, Microsoft, Apple, Amazon, PayPal, and most of the major banks now support passkeys as a primary login, and roughly a quarter of the user base has actually turned the option on. Adoption on the business SaaS side is around 15 percent, and on the legacy application side it runs closer to 8 percent. The technology has stopped being the story. The rollout pace is the story.
What changed to make the rollout real. The platform vendors have sorted out the sync story, so a passkey set up on an iPhone shows up on a MacBook and on a Windows PC without a separate enrolment step. Apple iCloud Keychain, Google Password Manager, and Microsoft Windows Hello all handle the sync, which is the part that used to be the user experience problem. The password manager vendors have done their part: 1Password, Bitwarden, and Dashlane all store passkeys now, so a user who lives in a password manager can use the same passkey across every device the manager runs on. The developer tooling has finally matured: the WebAuthn libraries, the FIDO2 SDKs, and the platform native APIs are all good enough that a competent engineer can ship a passkey implementation in a sprint rather than a quarter.
Where adoption has actually happened
The consumer side leads, and the numbers are visible. Google, Microsoft, Apple, Amazon, PayPal, eBay, and most of the major banks have shipped passkey support, and user adoption on the bigger consumer apps runs between a quarter and two fifths of the user base depending on the geography. The business SaaS side is the second wave, and the pace ties to the IT rollout. Salesforce, Workday, ServiceNow, and the major productivity tools all support passkeys, and user adoption there sits at 10 to 20 percent depending on how aggressive the IT org has been with the migration. The legacy application side is the laggard, and the numbers show it. The on prem applications, the custom internal tools, and the older SaaS that has not been touched in five years: passkey support is mostly absent, and user adoption sits in the 2 to 5 percent range. The three layers of the application estate move at very different speeds.
What is still in the way
The legacy application problem is the obvious blocker, and the obvious one tends to be the hardest to fix. An on prem application that was written in 2014 and has not been touched since does not get a passkey upgrade in a quarter. The legacy apps are the apps the business has to keep using, and the legacy apps are the ones the passkey rollout will take years to clear.
The account recovery problem is the less obvious blocker, and the one that bites the user the hardest. A user who loses the device with the passkey, who switches to a new phone, or who wipes the laptop, has to go through the account recovery flow, and the account recovery flow is the part of the passkey story that the platform vendors have not finished. The recovery flow that exists in 2026 is better than the one that existed in 2024, and the recovery flow is still the single biggest source of support tickets at every large passkey deployment.
The IT rollout problem is the third blocker, and the one that takes the longest to clear. Platform support, password manager deployment, user training, documentation, and the support runbook are each a project, and most IT orgs do not have the bandwidth to run them all at once. A CISO who plans for the legacy, plans for the recovery, and plans for the rollout pace will land the passkey transition without a ticket avalanche.
The bottom line
Passkey adoption has turned. The platform sync, the password manager support, and the developer tooling have made the rollout real, and the consumer side is the proof. The legacy applications, the account recovery flow, and the IT rollout pace are the work that remains.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
