Topic starter
11/07/2026 8:27 pm
TL;DR: Passkeys now account for 62% of one million 2025 authentication challenges, with autofill at 65%, according to Authsignal, while the FIDO Alliance reports more than 1 billion people have activated at least one passkey and consumer awareness rose from 39% to 57%. The governance issue is no longer readiness but rollout design: adoption is happening faster than many IAM programmes have adjusted.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “What issuing and verifying millions of passkeys has taught us at Authsignal”.
By the numbers:
- Passkeys now account for 62% of all authentication challenges in a sample of one million transactions in 2025.
- Passkey autofill makes up 65% of all authentication challenges, showing that users prefer the seamless flow.
- Over 95% of iOS and Android devices are passkey-ready, removing a major deployment barrier.
Key questions
Q: How should teams implement passkeys in customer IAM without breaking existing sign-in journeys?
A: Start with the journeys that create the most friction, then define where passkeys are primary, where fallback is allowed, and which recovery paths remain acceptable.
Q: Why do passkeys reduce resistance when users already trust the login flow?
A: Passkeys gain traction when they appear after a successful secure interaction, because the user has already accepted the context and can see the convenience benefit immediately.
Q: What signs show that a passkey programme is fragmented across channels?
A: Look for uneven enrolment between mobile and web, high fallback reliance, and support requests that cluster around recovery rather than first-time setup.
Practitioner guidance
- Define passkey rollout sequencing Start with user groups that authenticate frequently or handle higher-risk data, then expand only after measuring enrolment, fallback usage, and support demand.
- Align web and mobile coverage Validate that the same passkey journey works across browser, native app, and account recovery paths before broad rollout.
- Prompt enrolment after trust-building events Offer passkeys immediately after a successful strong-authentication event, when users are already in a security-minded flow.
Bottom line: Passkeys have moved from experimentation into mainstream authentication, which changes the IAM problem from feasibility to rollout governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:57 pm
Passkeys are no longer an emerging authentication option but a rollout governance problem. When adoption reaches mainstream levels, the question changes from whether users will accept passwordless authentication to whether IAM programmes can govern its sequencing, fallback handling, and platform coverage. That is a different operating model from classic MFA rollout. The practitioner conclusion is that passkey strategy now belongs in identity governance, not just in authentication engineering.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: Should organisations prioritise passkeys over OTPs and magic links?
A: Usually yes, when phishing resistance and device binding matter most. Passkeys offer stronger assurance, while OTPs and magic links can still be useful as transitional methods or lower-assurance alternatives in a phased customer IAM rollout.
👉 Read our full editorial: Passkeys are reaching scale faster than enterprise IAM expected