The FIDO Alliance's 2026 data puts the number of passkeys in use at around 5 billion, and roughly three-quarters of consumers have at least one enabled. Yet more than half of organisations still rely mainly on phishable sign-in methods, and B2B SaaS adoption sits around 28%.
The gap is a product problem, not a technology one. Here's how to roll passkeys out so people actually use them.
Why now
- Phishing resistance: passkeys are bound to your domain, so a fake login page can't capture them
- Conversion: no forgotten passwords and fewer reset emails. Sign-in is a fingerprint or face scan
- Compliance: phishing-resistant MFA is increasingly expected in SOC 2 audits and enterprise security reviews
- Accessibility: WCAG 2.2's accessible authentication criterion favours methods without memory tests. See our EAA checklist
The rollout plan
Phase 1: add passkeys as an option (week 1–2)
- Implement WebAuthn through your auth provider (Auth0, Clerk, Supabase, Cognito and others now support it) or a well-maintained library
- Allow multiple passkeys per account, and show them in account settings with a device name and last-used date
- Support conditional UI (passkey autofill in the username field) so returning users don't need a separate button
Phase 2: nudge enrolment (weeks 3–8)
Adoption is driven by timing more than messaging:
- Prompt right after a successful password login: "Sign in faster next time with a passkey"
- Prompt after a password reset, when the pain is fresh
- Never block the user; allow "not now" and re-ask after a sensible interval
Phase 3: policy for B2B (month 2+)
The difference between optional and enforced is dramatic. Industry data shows B2B adoption of roughly 50–70% with admin policy enforcement, against 5–12% without.
- Let workspace admins require passkeys or SSO for their organisation
- Show admins an adoption dashboard: who has enrolled and who hasn't
- Pair with SSO (SAML or OIDC) for enterprises that centralise identity
Phase 4: retire weak fallbacks
Once adoption is high:
- Remove SMS one-time codes as a primary factor
- Make passwords optional for new accounts
- Keep a strong recovery flow: verified email plus a second factor, or an admin reset for B2B
Pitfalls we've seen
- Account recovery as the weakest link. If "forgot passkey" leads to an email-only reset, attackers will use that instead. Recovery must be as strong as the login
- Confusing cross-device flows. Test the QR-code flow (sign in on a laptop with a phone) with real users
- Shared devices. Shared logins on shop-floor tablets need a different design, such as SSO or device-bound passkeys plus a PIN
- Analytics gaps. Instrument every step of the ceremony, or you won't know where users drop off
Metrics that prove it worked
| Metric | Why it matters |
|---|---|
| % of active users with a passkey | Adoption |
| % of sign-ins using a passkey | Real usage, not just enrolment |
| Sign-in success rate and time to sign in | Conversion and UX |
| Password reset volume | Support cost |
| Account takeover incidents | Security outcome |
Bottom line
Passkeys are production-ready. The work is in prompts, policy and recovery. Ship them as an option, nudge at the right moments, let B2B admins enforce them and retire the weak fallbacks.
Our custom software team implements passkeys, SSO and secure recovery for SaaS products. Talk to us or check pricing.
Frequently asked questions
What is a passkey?
A passkey is a phishing-resistant credential based on the FIDO2 and WebAuthn standards. The private key stays on the user's device or password manager and is unlocked with biometrics or a PIN, so there's no password to steal or reuse.
Should we remove passwords when we add passkeys?
Not at first. Offer passkeys alongside existing sign-in, nudge users to enrol, and only make passwords optional, or remove them, once passkey adoption and recovery flows are proven.
How do users recover their account if they lose a passkey?
Synced passkeys in Apple, Google or password-manager accounts survive device loss. For extra safety, allow multiple passkeys per account and keep a verified recovery path such as email plus a second factor, or an admin reset for B2B.
Do passkeys help with compliance?
Yes. Phishing-resistant MFA is increasingly expected by SOC 2 auditors, cyber-insurance questionnaires and enterprise security reviews, and passkeys also help meet WCAG 2.2's accessible authentication criterion.