Per the FIDO Alliance, around 5 billion passkeys are now in use and passkey logins succeed about 93% of the time versus about 63% for passwords. Yet 57% of organisations still use a phishable method as their primary sign-in.
Awareness isn't the problem. Implementation is. Here's what shipping passkeys properly actually involves.
How a passkey works (FIDO2 / WebAuthn)
-
Registration: your server sends a random challenge; the browser calls
navigator.credentials.create(); the authenticator generates a key pair and returns the public key plus a credential ID. - Storage: you store the public key and credential ID against the user. The private key never leaves the device.
-
Sign-in: your server sends a new challenge; the browser calls
navigator.credentials.get(); the device signs it after a biometric/PIN check; your server verifies the signature with the stored public key.
No shared secret means no phishing-replayable credential, no credential stuffing and nothing worth stealing from your database.
What "done properly" requires
- WebAuthn-compliant client and server code (challenge handling, origin and RP ID validation, signature verification)
- A fallback for unsupported devices
- A deliberate account-recovery design: backup passkey, identity-verification fallback, user education at signup
Cross-device sync happens via iCloud Keychain, Google Password Manager and others, but cross-ecosystem sign-in may need a QR-code flow, so test across ecosystems.
The FIDO research notes about half of organisations rely on developers with limited authentication experience, and fewer than a third have dedicated IAM engineers. Don't hand-roll the crypto; use a vetted library and review the recovery paths.
Measure the right thing
There's a 12–18 percentage-point gap between passkeys saved and passkeys used in the last 30 days. Track active use over a rolling window, not registrations.
Where to prioritise
- Financial / sensitive-data products
- High password-reset support volume
- Apps already using biometric unlock
Low-stakes internal tools and infrequent-login products can wait if the fallback is adequate.
Adoption by industry (FIDO): fintech ~60%, eCommerce ~35%, SaaS ~28%, media ~18%.
Full guide with six FAQs: auraveni.com
Top comments (0)