Passkey Adoption Statistics: Sourced Figures on Accounts, Awareness and Rollout

Passkey adoption figures are quoted everywhere, but most of them are lifted from roundups with no source, no sample and no year. This page collects the passkey statistics that can be traced to the publisher that produced them: the FIDO Alliance Passkey Index 2026, the FIDO Alliance State of Passkeys 2026 consumer and workforce studies released on World Passkey Day, and platform announcements from Google and Microsoft. Each figure carries its source, its year and, where the publisher gives it, the sample. It is written for identity leaders building a business case and for practitioners who need honest numbers for a rollout plan. It covers passkeys only; for broader multi-factor authentication figures, see MFA Adoption Statistics, and for how passkeys work, the Passwordless and Passkeys Guide.

Last reviewed: November 2026.

Key takeaways

• Passkeys now carry about a third of consumer sign-ins at large services: 36% of successful sign-ins across the Passkey Index 2026 participants used a passkey, up from 26% in the 2025 Index.
• Usage has almost caught up with enrolment: 38% of active accounts had a passkey and 36% of sign-ins used one in 2026, a 2-point gap against 8 points in 2025.
• Passkeys sign in more reliably: the Index reports a 93% sign-in success rate for passkeys against 78% for passwords and traditional MFA.
• Awareness is no longer the barrier: 90% of 11,000 consumers surveyed for FIDO in April 2026 had heard of passkeys and 75% had enabled one on at least one account.
• The workforce lags consumers: 68% of 1,400 enterprises are deploying or piloting passkeys, yet 57% still rely on a phishable method for primary day-to-day sign-in.

The sources behind passkey statistics

Three kinds of source produce credible passkey numbers, and they measure different things. Mixing them without saying so is the most common error in passkey reporting.

The Passkey Index figures are unweighted averages across the participants that answered each question. The FIDO Alliance describes the year on year comparison as directional because the participant group grew from 9 to 15 services. Survey figures are what people say they do, which tends to run ahead of what telemetry shows.

How many passkeys are in use

• Global estimate: the FIDO Alliance estimated on World Passkey Day 2026 (7 May 2026) that about 5 billion passkeys are in use worldwide, calculated from publicly available data and its own deployment data. This is a modelled estimate, not a count.
• Microsoft: on 1 May 2025 Microsoft reported nearly a million passkeys registered every day and said brand-new Microsoft accounts are passwordless by default.
• Google: on 2 May 2024 Google said passkeys had been used to authenticate users more than 1 billion times across over 400 million Google Accounts in less than a year, and that passkeys were used more often each day than SMS and app-based one-time passwords combined.

Treat the platform numbers as snapshots tied to their date. They show direction and scale, but they are not comparable with each other: one counts registrations per day, the other counts accounts that have used a passkey.

Eligibility, enrolment and share of sign-ins

The Passkey Index is the only recurring source that measures the funnel from offering passkeys to people actually using them.

Seven of the 13 participants that answered offer passkeys to their entire account base. Nine of 13 plan to offer passwordless accounts within 12 months. The narrowing gap matters more than the headline: in 2025 many users had created a passkey but still signed in another way, while in 2026 most users with a passkey were using it. For a rollout, that suggests the work has moved from getting people to create passkeys to removing the fallback paths that let them skip them.

Sign-in success, speed and cost

The Microsoft and FIDO success rates differ because they measure different populations and methods. Quote each with its source rather than averaging them.

Security outcomes reported by deployers

• Phishing: all 8 Passkey Index 2026 participants that measure it reported fewer successful phishing attacks since deploying passkeys. This question was new in 2026, so there is no trend yet.
• Account takeover: three participants reported fewer account takeovers and one reported virtually none among users who sign in with a passkey. FIDO presents these as individual observations, not averages.
• Consumer exposure: 33% of consumers in the FIDO State of Passkeys 2026 study had a confirmed account compromise or a breach notification in the past year (US 41%, Europe 31%, APAC 30%).
• Workforce outcomes: among enterprises that had begun a rollout (n=945), 47% reported improved security confidence, 35% fewer password reset help desk tickets and 32% fewer phishing incidents (FIDO State of Passkeys 2026).

No source here gives a measured, pooled reduction in account takeover. If a vendor deck quotes one, ask for the sample and method.

Consumer awareness and behaviour

Of the 75% who had enabled passkeys, 40% had done so on most accounts and 35% on a few. The survey covered the United States, United Kingdom, France, Germany, Australia, Singapore, Japan, South Korea, China and India.

Enterprise and workforce rollout

The gap between 68% deploying and 57% still relying on phishable primary sign-in is the most useful workforce figure. Pilots are common; replacing the default method is not. Legacy compatibility and recovery are where programmes stall, which matches the patterns in the Passkey Rollout Guide and Passkey account recovery.

Standards context for the numbers

• NIST SP 800-63B-4: permits syncable authenticators such as synced passkeys at AAL1 and AAL2, states that they shall not be used at AAL3 because the private key is exportable, and requires verifiers to offer at least one phishing-resistant option at AAL2. Workforce figures for "passkey based" sign-in do not tell you which assurance level is met.
• Control mapping: passkey coverage is evidence for NIST CSF 2.0 PR.AA-03 (users, services and hardware are authenticated) and NIST SP 800-53 IA-2 and IA-5 (identification and authentication; authenticator management).

Caveats when quoting passkey statistics

• Who answers: Passkey Index participants are large consumer services that chose to share data, so their rates are likely higher than the average relying party.
• Self-report versus telemetry: 75% of consumers saying they enabled a passkey and 38% of active accounts holding one are different measures and should never be presented as a trend.
• Estimates: the 5 billion figure is modelled by the FIDO Alliance, not counted.
• Dates: platform figures from 2024 and 2025 are snapshots and will be out of date; cite them with their date.

What the numbers mean for defenders

• Measure the funnel, not the launch: track eligibility, enrolment and share of sign-ins separately, as the Passkey Index does. A launch with 40% enrolment and 10% sign-in share has a fallback problem.
• The fallback is the attack surface: phishing reductions come from removing passwords and SMS codes as routine paths, not from adding passkeys beside them. The 57% phishable primary sign-in figure shows how many workforces have not taken that step.
• Recovery decides the outcome: recovery and device restoration is a top-three barrier in the workforce study. A recovery flow that falls back to SMS or help desk knowledge questions reintroduces the risk passkeys remove. See Top 10 Passkey Deployment Mistakes.
• Use success rate for the business case: a 93% against 78% success gap (FIDO, 2026) and lower SMS costs are easier to defend to finance than a security claim with no pooled figure behind it.
• Be clear about assurance: synced passkeys meet AAL2 under SP 800-63B-4; privileged and high-risk access needs device-bound, non-exportable keys. See the Phishing-Resistant MFA Guide.

Practitioner checklist

• Quote every passkey figure with publisher, report name, year and sample size, and never mix telemetry with survey results in one chart.
• Instrument your own funnel: eligible accounts, accounts with a passkey, share of sign-ins by method, and sign-in success by method.
• Set a target for retiring fallback methods (password, SMS, email code) per user population, not only an enrolment target.
• Track help desk resets and SMS spend before and after rollout so you can report outcomes in the same terms as the Passkey Index.
• Design and test account recovery before scaling; record the share of recoveries that fall back to a phishable method.
• Map populations to assurance levels: synced passkeys for AAL2 use cases, device-bound authenticators for AAL3 and privileged roles.
• Re-check the figures each May (World Passkey Day) and October (Passkey Index) and update internal decks.

Standards and references

• FIDO Alliance: Passkey Index, October 2026 (PDF)
• FIDO Alliance: Passkey Index 2026 executive summary
• FIDO Alliance: The State of Passkeys 2026, Global Consumer and Workforce Report (PDF)
• FIDO Alliance: Accelerating global passkey adoption on World Passkey Day 2026
• NIST: SP 800-63B-4 Digital Identity Guidelines, Authentication and Authenticator Management
• Microsoft: Pushing passkeys forward
• Google: Passkeys, Cross-Account Protection and new ways we are protecting your accounts

Related NHI Mgmt Group resources: Passwordless and Passkeys Guide · MFA Adoption Statistics · Passkey Rollout Guide · Identity Attack Statistics Guide · Passwordless and MFA Buyer's Guide