Notifications
Clear all
Topic starter
10/07/2026 9:09 pm
TL;DR: Passkey rollouts often plateau after initial sign-in gains because users do not see passkeys when they expect them, stale credentials still surface, and recovery flows create doubt, according to Authsignal. The real adoption lever is configuration discipline, not the ceremony itself: autofill, immediate availability, signal APIs, and quiet upgrades determine whether passkeys become trusted default behaviour.
NHIMG editorial — based on content published by Authsignal: The passkey UX patterns that drive adoption in 2026
By the numbers:
- As of June 2026, Conditional Create is supported in Safari 18+ on macOS, browsers on iOS/iPadOS 18+, Chrome 136+ on desktop, and Chrome 142+ on Android.
- Air New Zealand saw over 30% of customers opt into passkeys on prompt and call center volume drop 5 to 10% after rollout.
Questions worth separating out
Q: How should security teams implement passkeys without hurting login conversion?
A: Start with autofill in the existing sign-in form, then use immediate credential flows only where user intent is obvious.
Q: Why do passkey programmes stall after an initial rollout?
A: They stall when users cannot see the credential at the right moment, when stale credentials still appear, or when failures make the method seem unreliable.
Q: What do security teams get wrong about passkey recovery and upgrade flows?
A: Many teams treat passkey enrolment as a one-time event instead of a lifecycle.
Practitioner guidance
- Add passkey autofill to the existing sign-in field Use conditional mediation on the username or email form so passkeys appear in the browser's existing autofill surface instead of a separate modal.
- Limit immediate credential flows to high-intent moments Use immediate availability checks only where the user has already signalled intent, such as returning to the app, checking out, or performing a step-up action.
- Signal stale or unknown credentials back to the provider After a failed passkey verification for an unknown credential, call the signal path so the provider stops offering credentials your backend will reject.
What's in the full article
Authsignal's full blog post covers the implementation detail this post intentionally leaves for the source:
- Code-level WebAuthn examples for conditional mediation, including the exact browser request pattern.
- Platform-specific behaviour differences for Chrome, Safari, iOS, Android, and credential providers.
- Operational guidance for signalUnknownCredential, signalAllAcceptedCredentials, and signalCurrentUserDetails.
- A rollout checklist that ties creation rate, success rate, fallback rate, and error handling to production monitoring.
👉 Read Authsignal's analysis of passkey UX patterns that drive adoption in 2026 →
Passkey UX patterns in 2026: what is actually moving adoption?
Explore further
10/07/2026 9:32 pm
Passkey adoption is a trust problem before it is a standards problem. The article shows that users abandon passkeys when the browser surface, backend acceptance rules, and recovery experience are out of sync. That is not a cryptographic failure, it is an identity lifecycle failure in the login path. Practitioners should treat passkey trust as a stateful user expectation that can be damaged by one bad experience.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: How do teams know whether passkeys are actually working?
A: Look at passkey creation rate, passkey sign-in success rate, fallback rate, and unknown credential errors together. A healthy programme shows increasing successful use without a rising support burden. If users keep falling back or encountering invalid credentials, the authentication experience is not yet trustworthy.
👉 Read our full editorial: Passkey adoption stalls when UX patterns break trust and discoverability
