FIDO estimates five billion passkeys in use

The estimate and survey findings

FIDO’s five-billion figure is an ecosystem estimate, not a live counter that can identify every credential on every device. The organization paired that estimate with research involving 11000 consumers and 1400 enterprise decision-makers across ten countries. In the survey, 90% of consumers said they were aware of passkeys, 75% had enabled one on at least one account and 49% used them regularly when the option was available. Those are self-reported research results, so they describe the surveyed population rather than universal behavior.

FIDO reported that 68% of organizations had deployed passkeys or were actively deploying them for employee sign-ins, and 82% described a fully passwordless workforce as an ultimate goal. Organizations that had deployed passkeys associated them with faster login, stronger security confidence and fewer support problems. At the same time, the report says many workplaces still rely on authentication methods that can be phished, so deployment does not mean phishing-resistant sign-in is used throughout an organization.

How passkeys resist phishing

A passkey uses public-key cryptography and is bound to the service for which it was created. The server stores a public key, while the private credential remains protected by the user’s device or credential provider. Sign-in is approved with the same device gesture people already use for local unlock, such as a fingerprint, face check or PIN. Because the credential is scoped to the legitimate site or app, a convincing look-alike page cannot simply collect a reusable secret in the way it can steal a password.

Passkeys also change the sign-in routine. There is no password to invent, remember, type on a small keyboard or rotate after another company reports a breach. Yet a responsible rollout still needs clear answers for device replacement, account recovery, shared devices and people who cannot use a preferred biometric method. Platforms should keep recovery resistant to social engineering, explain where a passkey is saved and provide an accessible fallback without quietly rebuilding the weakest parts of password authentication.

Setup and recovery

With five billion credentials estimated to be in use, services still need to explain passkey prompts and provide recovery when a device is lost or replaced. Services that offer passkeys only after a long trip through security settings will see different results from those that introduce them at a useful moment and explain the benefit in one sentence. Passwords will remain during a long transition, especially on legacy and rarely used accounts. The transition depends on setup and recovery being usable as well as secure.