Password removal is no longer hypothetical
Authenticate 2026 and the FIDO Passkey Index 2026 gave the first broad production data on what happens when companies stop treating passkeys as an add-on and start removing passwords across sign-up, login, and recovery.
The headline is simple: this has moved from roadmap talk to live rollout. The FIDO Passkey Index 2026 found that 9 of 13 participating relying parties plan passwordless accounts within the next 12 months. Across Index participants, 36% of successful sign-ins already use a passkey, up from 26% in 2025.
That matters because the core problem is no longer just passkey availability. It is whether teams are willing to remove the phishable fallback that keeps dragging users back to passwords, OTPs, and account takeover paths.
Mercari shows what full password removal looks like
Mercari is the clearest end-to-end example because it changed all three surfaces: sign-up, login, and recovery.
At sign-up, it first made passkey creation the main path and demoted password registration to a small fallback link. Then it removed the password step entirely behind a feature flag. Passkeys are still skippable for users who cannot create one, but the impact was large: password sign-ups dropped from about half of new users to about 1%.
At login, Mercari moved to an identifier-first flow that decides per account which method should be offered. That is the part many teams miss. Password removal was not one global switch.
Mercari used account- and risk-based rules such as:
- a registered passkey disables the password for that account
- a risky environment can suppress the password for that login
- detected account takeover revokes the password and ends the session
- a password login via password manager can trigger passkey creation and then remove the password
After three years, Mercari said password reliance at login fell from 75% to 22%, while passkeys reached 41.2% of logins.
Most teams are learning the same tradeoff
The recurring pattern across Meta, PayPal, Capital One, eBay, Microsoft, and GM is that password removal is not blocked by passkey support alone. It is blocked by edge cases, recovery confidence, and rollout safety.
Here is the practical split:
| Company | Main lesson |
|---|---|
| Meta | Make passkeys mandatory before turning passwords off, but only when recovery is strong enough |
| PayPal | Passkeys do not stop takeover if SMS OTP and password fallbacks still exist |
| Capital One | Adoption jumps when the login UI actively promotes passkeys, not just supports them |
| eBay | Device coverage matters; cross-device issues can make password removal unsafe |
| GM | Workforce rollouts succeed when exceptions are designed first |
| Microsoft | System-preferred authentication can materially change usage patterns |
A few examples stand out.
Capital One pushed web passkey usage from 12% to 65% by changing the login screen, adding Conditional UI autofill, and triggering an autoprompt on page load. Microsoft reported that system-preferred authentication increased passkey sign-ins across the Entra user base by 380%. GM rolled out passwordless, phishing-resistant authentication to more than 200,000 workforce users in 19 waves.
The hard part is knowing when a user is ready
The safest teams are not removing passwords blindly. They are removing them only when the user shows the right signals.
Those signals show up repeatedly in the case studies:
- The user actually uses passkeys consistently.
- A backup or recovery method exists.
- The user does not regularly fail on their real devices.
- The environment is low enough risk to suppress phishable fallback.
That explains why eBay is cautious. It reported 93% passkey sign-in success, but also found that cross-device problems are a top reason people stop using passkeys. If desktop users still hit stale credentials or cross-device friction, removing the password too early creates lockouts instead of better security.
This is also why observability matters. Corbado is a passkey observability and adoption platform for large B2C enterprises. The article argues that teams need visibility into real method reliance, device health, and passkey-specific failure reasons before they can safely disable passwords per user or per segment.
The 2026 takeaway
The interesting shift in 2026 is not that more companies support passkeys. It is that leading teams are now removing passwords in production, one surface and one cohort at a time.
The winning pattern is pretty consistent: change the UI, measure real usage, close phishable fallbacks, protect recovery, and keep a kill switch for every rollout step.
Read the full breakdown.
Top comments (0)