Why do some websites still not offer passkey login?
Key takeaways
- Passkeys are faster and phishing-resistant, yet only 26% of sign-ins on passkey-enabled services actually use them, per the FIDO Alliance's 2026 index.
- The biggest blocker is account recovery: weak fallback options like SMS codes reduce the whole system to password-level security.
- Legacy systems, inconsistent cross-platform UX, and underestimated engineering costs keep most websites running passwords alongside passkeys.
A passkey is a login credential stored on your phone or computer that replaces the typed password. Instead of remembering a string of characters, you verify yourself with the same fingerprint, face scan, or PIN you already use to unlock your device.
The technology underneath, called WebAuthn, uses public-key cryptography: your device keeps a private key and hands the website a matching public key. Nothing you type can be phished, replayed, or stolen from a breached database.
This article takes a closer look at why most websites still do not offer passkey login, including the account-recovery trap, legacy infrastructure, the hidden engineering cost, the inconsistent login experience, and what the latest adoption numbers actually say.
What a passkey actually is, in 60 seconds
When you register a passkey, your device creates a unique pair of cryptographic keys for that website. The private key never leaves your device. The website stores only the public key, which is useless to an attacker.
To sign in, the website sends your device a random challenge. Your device signs it with the private key after you unlock it with a fingerprint, face scan, or PIN. The website checks the signature with its public key and lets you in.
Major platforms began rolling this out in 2022, and Google enabled passkeys for all consumer accounts in May 2023 under the headline "The beginning of the end of the password." The results look impressive on paper. According to the FIDO Alliance's Passkey Index, published in October 2025 with data from Amazon, Google, Microsoft, PayPal, TikTok, and four more companies, passkey sign-ins succeed 93% of the time versus 63% for traditional methods, and take 8.5 seconds instead of 31.2.
So why is the password still everywhere?
The short answer: websites are not ready to bet on passkeys alone
The FIDO Alliance reported in May 2026 that around 5 billion passkeys are now in use worldwide, and that 90% of people have at least heard of them. That sounds like a finished revolution until you read the next number: on services where passkeys are already available, only 26% of sign-ins actually use them.
"Passkeys are moving into the mainstream because they deliver something the industry has struggled to achieve for decades: authentication that is both more secure and easier to use," said Andrew Shikiar, Executive Director and CEO of the FIDO Alliance, in the May 2026 announcement.
Mainstream, yes. Finished, no. Around 57% of organizations still rely on phishable authentication for their primary day-to-day sign-ins, per the same FIDO report.
The reasons are structural, and they start with the problem nobody likes to talk about.
The account-recovery trap
This is the engineering reason most websites keep passwords, and it is the one vendors discuss the least.
A passkey lives on your device. If that phone is lost, stolen, broken, or simply replaced, you can be locked out of every account tied to it. So every website needs a recovery path for exactly that moment.
Here is the trap: if the recovery path is a plain email link or an SMS code, attackers do not bother attacking the passkey at all. They trigger the recovery flow and walk in through the weak fallback.
The security of the whole system drops to the security of the fallback. Identity specialists at Strivacity describe this as the central design problem of passkey rollouts: a strong credential protected by a weak recovery process is not a strong system.
The alternative is designing recovery that stays phishing-resistant, and that is genuinely hard. It means backup authenticators, cross-device sync with encryption, identity verification at help desks, and policies for what happens when everything is lost at once. Kaspersky's analysis from July 2025 notes that companies rolling out passkeys find old problems shrinking while new ones appear, "such as lost devices containing passkeys," which replace familiar "forgot password" support tickets with a harder support problem.
Faced with that choice, most websites keep the password as the safe fallback rather than solving recovery properly.
Legacy systems cannot be migrated overnight
For many organizations, the barrier is not willingness but plumbing.
A large share of corporate IT still runs on on-premises Active Directory and isolated legacy systems. Kaspersky's Stan Kaminsky wrote in July 2025 that migrating passkeys onto that kind of infrastructure ranges from "difficulty" to "outright impossibility." The directory that owns your office login was built around passwords and smart cards, not WebAuthn.
There is a second layer for business software. A B2B product does not just need passkeys; it needs passkeys alongside enterprise single sign-on, directory sync, and the SAML and OIDC integrations that corporate customers require.
Identity analyst Deepak Gupta has argued that passkeys are complementary to those enterprise layers. That means a site cannot ship passkeys alone; it has to build and maintain both tracks.
The engineering cost is bigger than it looks
Adding a "sign in with passkey" button is the easy part. What follows is the part teams underestimate.
A website that offers passkeys takes on the full credential lifecycle: enrollment, cross-device UX, sync behavior differences between Apple, Google, and Microsoft, revocation, recovery, and fallback design. Then there is what Gupta calls the ongoing browser tax: every browser ships new WebAuthn features on its own schedule, and someone on the website's team has to track each one, test against it, and handle the cases where platforms disagree.
WebAuthn itself keeps moving. Level 3 of the standard became an official W3C Recommendation on August 25, 2026, adding features like related-origin requests and a signal API.
Every one of those additions is work for the teams implementing it. Gupta's advice is blunt: build passkeys yourself only if your login flow is simple and you will staff that ongoing browser-tracking cost.
For a small website with a two-person engineering team, that math rarely works out. So they wait.
The login experience is still inconsistent
Even where passkeys exist, the experience varies. On one site the flow is smooth; on another it asks confusing questions about which device, which browser, or which platform account you are signed into.
Fei Liu, a senior emerging tech researcher at Okta, described the imbalance at the RSAC Conference 2025 in San Francisco: "The power is concentrated in the hands of platform providers, while the users hold the least power."
That concentration has a practical cost. Apple, Google, and Microsoft each run their own passkey sync, their own UI, and their own recovery rules, and they each have incentives to keep users inside their ecosystem. Users end up unsure which passkey works with which combination of browser and device.
Knowledge gaps make it worse. Business Standard's reporting on the slow death of passwords found that many services surface a passkey option without explaining it, so non-technical users stick with what they know. And a meaningful minority of organizations are not convinced they need to move at all: among companies that have not gone fully passwordless, 16% say "passwords plus MFA are currently sufficient," and 24% are explicitly waiting for the technologies and standards to mature, according to the FIDO Alliance's 2026 survey of 1,400 decision-makers.
What the adoption numbers actually say
Strip away the marketing and the picture is mixed but moving.
On the consumer side, Sapio Research polled 11,000 consumers across 10 countries in April 2026 for the FIDO Alliance. Awareness of passkeys sits at 90%, up from 39% in 2022. About 75% have enabled a passkey on at least one account, and 49% use passkeys regularly wherever they are available.
On the business side, 68% of organizations have deployed passkeys for employee sign-ins or are actively doing so, but only 28% describe themselves as fully passwordless. Among the rest, the largest single reason is inertia plus that wait-for-maturity camp described above.
The big platforms are the proof that it can work at scale. Google reports 2.5 billion passkey authentications across 800 million accounts, per the FIDO Alliance's roundup.
Amazon says 175 million of its users now have passkeys. TikTok reports that passkey logins are 17 times faster for its users.
When this finally changes
A few forces are pushing in the right direction.
The standards are maturing. WebAuthn Level 3 reaching full W3C Recommendation status in August 2026 removes one excuse from the "waiting for the standards" camp. Cross-platform credential exchange work is also progressing, which would soften the ecosystem lock-in that Liu and others criticize.
Regulation and liability may do what enthusiasm could not. As breach-notification costs rise and insurers ask harder questions about authentication, the business case for passkeys gets easier to make to a CFO. The 5-billion-passkey milestone suggests the infrastructure is past the point of no return even if individual websites are slow.
None of this means passwords vanish. The realistic path is hybrid: passkeys as the default, passwords as the fallback, for years. What changes is which one you reach for first.
What you can do in the meantime is simple. Enable passkeys on the big accounts where they already work; the setup flow on a Google account takes a few minutes and is a good first one.
Register more than one authenticator where you can, so losing one device does not lock you out. And keep your recovery email and phone number current, because the fallback you set today is the one you will depend on when something breaks.
If you want the full technical background, our plain-English WebAuthn explainer covers how the cryptography works and why it resists phishing. For the bigger picture of how login security connects to the devices around you, see how satellite messaging extends connectivity when there is no network at all.
The bottom line
Websites still do not offer passkey login mainly because the hard parts are not the login itself. They are account recovery, legacy infrastructure, and the ongoing cost of tracking every browser's implementation. Until recovery design catches up, most sites will keep passwords as the familiar fallback.
The shift is real, at 5 billion passkeys and counting, but it is a migration, not a flip of a switch. Enable passkeys where they exist, register a backup, and the web will meet you halfway.
Tags: passkeys, WebAuthn, login security, passwords
Latest in Tech
- How to set up a passkey on your Google account step by step
- What is WebAuthn in simple terms: a plain-English explainer
- What is satellite messaging on phones and how it works
Subscribe for one practical tech explainer a day, written from real sources.
Related stories
Apple plans two October launches: smart home hub, OLED MacBook Pro
Apple set October 13 for a smart home launch with a new hub, Apple TV 4K and HomePod mini, then October 27 for OLED MacBook Pro models
How to Check If Your Phone Supports eSIM in 30 Seconds
Dial *#06# and look for an EID number to confirm eSIM support in under 30 seconds. This guide also walks through the iPhone and Android
eSIM vs iSIM: what is the difference?
An eSIM is a dedicated chip on the phone's board, while an iSIM lives inside the processor itself. Qualcomm's Snapdragon 8 Gen