---
title: "Passkeys carry 36% of sign-ins, up from 26%: the gap to enrolment nearly closed"
summary: "Passkey share of successful sign-ins at the consumer services in the FIDO Alliance’s Passkey Index, October 2025 against October 2026."
url: https://www.thetechbag.com/blog/passkey-sign-ins-rise-fido-index
format: Trend
desk: "Identity & access"
published: 2026-10-15
facts_checked: 2026-10-15
author: TechBag (The TechBag Journal)
tags: ["passkeys","FIDO Alliance","Passkey Index","phishing-resistant MFA","Google","Microsoft","NIST SP 800-63B-4","SMS OTP","RBI"]
cover: https://www.thetechbag.com/blog/covers/passkey-sign-ins-rise-fido-index.png
---

# Passkeys carry 36% of sign-ins, up from 26%: the gap to enrolment nearly closed

*Passkey share of successful sign-ins at the consumer services in the FIDO Alliance’s Passkey Index, October 2025 against October 2026.*

Trend · Identity & access · By TechBag · Published 2026-10-15 · Facts checked 2026-10-15 · Canonical: https://www.thetechbag.com/blog/passkey-sign-ins-rise-fido-index

The short version

- 36% of successful sign-ins at the consumer services in the FIDO Alliance’s Passkey Index now use a passkey, against 26% in last year’s Index. The panel grew from 9 to 15 companies, so FIDO calls the comparison directional.[1][2]
- Use rose faster than enrolment. 38% of accounts have a passkey, so the gap between having one and signing in with it fell from about 8 points to about 2.[2]
- The drivers are on the record: Google and Microsoft made passkeys the default, the companies in the Index report higher success and lower SMS costs, and standards bodies and bank regulators are moving sign-in off typed codes. Staff sign-in is a separate, slower story.[4][5][6][8]

More than one in three successful sign-ins at the services in FIDO’s Passkey Index used a passkey in the 2026 edition, published on 15 October: 36%, up from 26% in the first Index a year earlier.[1] The 15 participants include Amazon, Google, Microsoft, PayPal, TikTok, WhatsApp, Shopify, JP Morgan Chase and Japan’s NTT DOCOMO, KDDI, LY Corporation and Mercari. FIDO’s own summary of the year: passkeys “have moved from deployment to adoption”.[2]

## The line: two readings, and the gap between having a passkey and using it

The Index has two published points. In October 2025, nine companies reported that 26% of sign-ins used a passkey. In October 2026, 12 of the 15 participants reported the measure, and their unweighted average was 36%. Sign-in share counts re-authentication and excludes account recovery.[2][3]

Enrolment moved less. 90% of active accounts are eligible for a passkey, and 42% of eligible accounts have one, which FIDO puts at roughly 38% of all accounts. A year earlier the figure was about 34%. In FIDO’s words, “people who have a passkey are now using it more of the time”. Even so, 8 of the 10 participants that report both measures still see fewer passkey sign-ins than passkey holders.[2]

**Figure: Passkey sign-ins rose 10 points in a year, enrolment 4: the gap closed from about 8 points to 2**

*Share of all accounts with a passkey and share of successful sign-ins using one, unweighted average of participants, FIDO Passkey Index, October 2025 and October 2026*

|  | Accounts with a passkey | Sign-ins using a passkey |
| --- | --- | --- |
| Index, Oct 2025 | 34 | 26 |
| Index, Oct 2026 | 38 | 36 |

Source: FIDO Alliance, Passkey Index (October 2025, 9 participants; October 2026, 15 participants, results compiled 21 September 2026) · as of 15 October 2026 · directional: the panel changed between years; the 2025 enrolment figure is the 2026 report's restatement (the 2025 report printed 36%)

## What drives it: defaults, measured results and regulators

**Platform defaults.** Google made passkeys “the default option across personal Google Accounts” on 10 October 2023, switching on “Skip password when possible” for users.[4] On 1 May 2025 Microsoft made brand-new Microsoft accounts “passwordless by default” and began steering existing users to their best method. It reported nearly a million passkeys registered a day, a sign-in success rate of about 98% against 32% for passwords, and password use down by more than 20% in its experiments.[5]

**The participants’ own numbers.** Passkey sign-ins succeed 93% of the time against 78% for passwords and traditional MFA (n=12), and save an average of 27 seconds each (n=9). All 8 participants that measure phishing report fewer successful attacks since deploying passkeys, and all 4 that shared savings report lower SMS one-time-code bills, from about US$1 million to hundreds of millions of dollars a year. Two participants still show a password or code before the passkey, even to users who have one; one of them estimates that putting the passkey first would roughly double its passkey share. 9 of 13 plan passwordless accounts within 12 months.[2]

**Regulators.** NIST’s SP 800-63B-4, final in August 2025, says verifiers “SHALL offer at least one phishing-resistant authentication option” at its middle assurance level, and that US federal agencies “SHALL require” phishing-resistant sign-in for their staff and contractors.[6] In the UAE, banks began phasing out SMS and email codes on 25 July 2025 under Central Bank directions, with full discontinuation due by March 2026, Gulf News reported; the replacement is in-app approval, not passkeys specifically.[7]

**Figure: Two platforms made passkeys the default and regulators moved sign-in off typed codes before the 36% reading**

*Dated events in platform defaults, regulation and FIDO measurement, October 2023 to October 2026*

| Date | Event | Detail |
| --- | --- | --- |
| Oct 2023 | Google: passkeys the default | Personal Google Accounts prompt users to create one |
| May 2025 | Microsoft: passwordless by default | New Microsoft accounts never need a password |
| Jul 2025 | UAE banks start dropping SMS codes | Phase-out of SMS and email codes begins (reported) |
| Aug 2025 | NIST SP 800-63B-4 | A phishing-resistant option must be offered at AAL2 |
| Oct 2025 | Passkey Index: 26% | Nine companies, first edition |
| Mar 2026 | UAE phase-out due | SMS and email codes to be discontinued (reported) |
| May 2026 | FIDO: 5 billion passkeys | FIDO's estimate of passkeys in use |
| Oct 2026 | Passkey Index: 36% | Fifteen companies |

Source: Google (10 Oct 2023); Microsoft (1 May 2025); NIST SP 800-63B-4 (Aug 2025); Gulf News (24 Jul 2025); FIDO Alliance (14 Oct 2025, 7 May 2026, 15 Oct 2026) · as of 15 October 2026 · the UAE dates are as reported by Gulf News; the Central Bank's directions were not published

## What it means for a company's staff sign-in

The Index measures consumer accounts, not employees. The workforce picture is slower: in FIDO’s April survey, 57% of organisations still signed staff in mainly with a factor a fake page can collect, which [our 7 May piece on workforce passkeys](https://www.thetechbag.com/blog/passkeys-phishable-mfa-workforce) takes apart, with prices at five identity providers.[8] The Index still carries three lessons for whoever runs sign-in at work.

First, count sign-ins, not enrolments: the 2025 gap, 34% of accounts against 26% of sign-ins, shows that holding a passkey is not using it. Second, the order of the sign-in screen matters: one participant estimates that showing the passkey first, and changing nothing else, would roughly double its passkey share. Third, a passkey offered beside a password and an SMS code leaves those weaker paths open, which is why FIDO names passwordless accounts as the next step.[2]

TechBag countTechBag count: support is common, not universal

Of the 30 products in our IAM, SSO and MFA guide, as it stood on 15 October 2026, 20 have documented FIDO2 or passkey support, 6 offer only other strong factors and 4 could not be established from vendor documentation. We count the vendor’s own documentation, not marketing claims. The guide’s product list is at [IAM, SSO and MFA](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa).

India: no Index figure

The Index gives no country split, and none of its 15 participants is an Indian company, though several, including Amazon, Google and WhatsApp, serve large Indian user bases.[2] The nearest Indian figure is FIDO’s May survey: 88% of Indian consumers had enabled a passkey on at least some accounts, against 75% across ten countries.[8]

India’s regulator has not followed the UAE. RBI’s Authentication Mechanisms for Digital Payment Transactions Directions of 25 September 2025, in force from 1 April 2026, require two factors for a digital payment, one of them dynamic, and are technology-neutral: SMS OTP remains a permitted factor.[9] For staff sign-in at an Indian company, there is no regulatory deadline; the Index’s measured results are the case.

**What to watch.** FIDO has published the Index each October, on 14 October 2025 and 15 October 2026; it has not announced a date for the third. That edition will show whether the nine participants planning passwordless accounts shipped them, and whether sign-in share passes enrolment. FIDO’s workforce and consumer survey has come out on World Passkey Day, 7 May.[1][3][8]

How we did this

Figures as of 15 October 2026

Index figures are FIDO Alliance’s, from its October 2025 report (nine participants, compiled with Liminal) and its October 2026 report (15 consumer relying parties, results compiled 21 September 2026). Submissions are confidential and percentages are unweighted averages across the participants that answered, so a small service counts as much as Amazon; n varies by question. FIDO itself calls year-on-year comparisons directional because the panel changed. The 2025 enrolment point (34% of all accounts) is the 2026 report’s restatement; the 2025 report printed 36% “of all accounts”, which the 2026 report reads as a share of eligible accounts. We do not compare success rates across years: 2025 set 93% against 63% for “other methods” including social login, and 2026 against 78% for passwords and traditional MFA. Microsoft’s figures are its own, for consumer accounts. The UAE dates come from Gulf News because the Central Bank’s directions are not public.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [FIDO Alliance: Passkey Index 2026 (executive summary)](https://fidoalliance.org/passkey-index-2026/) — 15 October 2026
2. [FIDO Alliance: Passkey Index, October 2026 (full report, findings 1 to 6 and Passkeys in practice)](https://fidoalliance.org/wp-content/uploads/2026/10/Passkey-Index-October-2026.pdf) — 15 October 2026
3. [FIDO Alliance: Passkey Index, October 2025 (full report)](https://fidoalliance.org/wp-content/uploads/2025/10/FIDO-Passkey-Index-October-2025.pdf) — 14 October 2025
4. [Google: Passkeys are now enabled by default for Google users](https://blog.google/technology/safety-security/passkeys-default-google-accounts/) — 10 October 2023
5. [Microsoft Security blog (Vasu Jakkal, Joy Chik): Pushing passkeys forward, Microsoft's latest updates for simpler, safer sign-ins](https://www.microsoft.com/en-us/security/blog/2025/05/01/pushing-passkeys-forward-microsofts-latest-updates-for-simpler-safer-sign-ins/) — 1 May 2025
6. [NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (AAL2 requirements)](https://pages.nist.gov/800-63-4/sp800-63b.html) — August 2025
7. [Gulf News: New rule, UAE banks to stop sending OTPs via SMS and email starting July 25 (trade press)](https://gulfnews.com/business/banking/new-rule-uae-banks-to-stop-sending-otps-via-sms-and-email-from-july-25-1.500209071) — 24 July 2025
8. [FIDO Alliance and Sapio Research: The State of Passkeys 2026, Global Consumer and Workforce Report](https://fidoalliance.org/wp-content/uploads/2026/05/The-State-of-Passkeys-Global-Consumer-and-Workforce-Report-1.pdf) — 7 May 2026
9. [RBI: Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025, RBI/2025-26/79](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12898) — 25 September 2025

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [IAM, SSO and MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — 30 products, with documented FIDO2 and passkey support flagged
- [IAM costs $3 to $17 a user a month](https://www.thetechbag.com/blog/iam-where-indian-companies-get-it-wrong) — where identity money goes and where breaches start