Disable Passwords: Real Case Data from 2026

1. Introduction#

Removing passwords has moved from roadmap slide to production. At Authenticate 2026, Mercari reported that password reliance at login fell from 75% to 22% after it removed passwords from sign-up, login and recovery. The FIDO Passkey Index 2026 found that 9 of 13 participating relying parties plan passwordless accounts within the next 12 months. Passkey sign-ins now make up 36% of successful sign-ins at Index participants. This recap collects what Mercari, Meta, PayPal, Capital One, eBay, Microsoft and General Motors shared about actually removing passwords, including the rules, guardrails and remaining gaps.

2. How many Companies plan Passwordless Accounts in 2026 and 2027?#

Most large consumer relying parties now plan to remove passwords for at least part of their user base. The FIDO Passkey Index 2026, presented by Diego Zavala (Director of Ecosystem Development, FIDO Alliance), found that 9 of 13 respondents plan passwordless accounts within 12 months. One of them plans it on an exploratory basis, one is researching and three have no plans yet.

The Index draws on confidential, unweighted data from 15 large consumer relying parties. No figure is attributed to a single organization, so the Index does not reveal which participants plan passwordless accounts. The 15 participants are Abanca, Amazon, Banesco, CVS, Google, JP Morgan Chase, KDDI, LY Corporation, Mercari, Microsoft, NTT DOCOMO, PayPal, Shopify, TikTok and WhatsApp.

Source: Diego Zavala (FIDO Alliance), Authenticate 2026

Zavala gave two reasons for passwordless accounts: they remove phishable fallbacks and they ensure users actually use the passkey they already have. Usage data supports the move. Passkeys account for 36% of successful sign-ins, up from 26% in 2025. Passkey sign-in success is 93% vs. 78% for passwords and MFA, and passkey sign-in is 2.8x faster. We break down these numbers in our Passkey Index 2026 analysis, and the full report is available from the FIDO Alliance.

Dashlane's Rew Islam and Tina Zhuo added an outside view: 40% of the top 1,000 relying parties by authentication volume support passkeys in 2026. In a sample of the top 60, only a handful see more than about 16% of authentications on passkeys. Their advice is to publish a password phase-out date. They cited HubSpot's goal to be fully passwordless by 2027.

3. How did Mercari remove Passwords from Sign-up, Login and Recovery?#

Mercari removed passwords in all three places where they live: registration, login and recovery. Tatsuya Karino (Engineer, Mercari) explained at Authenticate 2026 that 14 million passkey users were not enough, because attackers simply targeted the remaining password or email link. Mercari runs one account across its marketplace, the Merpay payment service and the Mercoin crypto exchange.

Source: Tatsuya Karino (Mercari), Authenticate 2026

3.1 Sign-up without a Password#

Mercari changed sign-up in two steps. First, passkey creation became the primary option, with a small "register with password" link. Then a feature flag removed the password step entirely. Passkeys stay skippable, because some users cannot create one. Password sign-ups fell from about half of new users to about 1%.

Source: Tatsuya Karino (Mercari), Authenticate 2026

3.2 Per-user Password Disabling at Login#

Mercari replaced its login menu with an identifier-first flow that offers one factor at a time. This lets Mercari decide per account which factors to allow:

• A registered passkey disables the password: Once a user creates a passkey, the password stops working for that account.
• A risky environment blocks the password for that login: A high risk score, for example from a residential proxy or VPN, removes the password option.
• Detected account takeover revokes the password: ATO detection ends the session and invalidates the password.
• Automatic upgrades remove the password too: A password login via a password manager can create a passkey through conditional create, which then removes the password.

Source: Tatsuya Karino (Mercari), Authenticate 2026

Results after three years: password reliance fell from 75% to 22%, passkeys reached 41.2% and login success rose by 13 points between January and September 2026.

Source: Tatsuya Karino (Mercari), Authenticate 2026

Corbado's Passkey Benchmark 2026 shows why the password option itself matters: with a simple post-login nudge, about 25% of passkey-ready users enroll, but only about 20% of their logins use the passkey because the login screen still offers the password. Passkey-first return flows reach 95% usage (Passkey Benchmark 2026).

3.3 Recovery without Password Reset#

Mercari replaced email-link password resets with identity proofing via ID document plus selfie or the My Number Card. Recovery no longer offers a password and disables any existing one.

4. Why has Meta not removed Passwords yet?#

Meta has not removed passwords yet because it wants to be sure no user loses access first. Jason Cheung (Product Marketing Manager, Meta) said at Authenticate 2026 that Meta uses signals such as an available recovery method or a second secure method, like a registered security key. Meta has created more than 100 million Meta account passkeys since it started in January 2026.

Alistair Thornton (Director, Product Management, Meta) described the sequence Meta follows:

1. Every user gets a passkey: Creation comes first.
2. The passkey is used in all relevant flows: Login, 2FA and reauthentication default to it.
3. Users can get back in if they lose it: Recovery has to work without the password.
4. Password logins get harder for passkey holders: Meta adds friction to non-passkey methods.
5. The password is switched off last: Removal follows once that balance is right.

With "passkey fortification", Meta already goes a step further for some users. For consistent passkey users, Meta is testing and rolling out the removal of phishable methods at 2FA, login challenges, certain reauth flows and recovery. Thornton also said Meta wants to start experimenting with passwordless registration for new accounts, with the caveat that it must work for 3 billion users.

Since August 2026, Meta has also been rolling out required passkey creation for users tied to ad business portfolios. What worked: a large optional base first, a grace period of 14 to 30 days with repeated warnings, briefed support and sales teams and close monitoring. Problems came from confusion about OS requirements and enterprise IT blocking Google Password Manager or iCloud Keychain. Despite these issues, Cheung called mandatory passkey creation "relatively low friction" overall. More on Meta's earlier rollout is in our Facebook passkeys analysis.

5. How does PayPal plan to remove phishable Fallbacks?#

PayPal shows that passkeys alone do not stop account takeovers while phishable fallbacks stay on the account. Rakan Khalid (Sr. Director, Identity Product Management, PayPal) said at Authenticate 2026 that PayPal sees no evidence of phishing among customers who log in with a passkey. Its next step is to test access with phishing-resistant authenticators only.

Takeovers still happen through SMS OTP and password fallbacks, after which attackers create passkeys in their own password managers. PayPal planned to test a scenario with no phishable authenticator at all "in the next few weeks" after the October 2026 conference.

PayPal's best opt-in entry point is password reset, while checkout brings volume. About 30% to 40% of users who see the checkout prompt try to enroll, and PayPal accepted some drop-off based on a break-even analysis. Khalid named a three- to four-month payback as an example of an acceptable break-even. Our PayPal passkeys analysis shows how the login flow looks in practice.

6. How did Capital One reduce Password Reliance step by step?#

Capital One reduced password reliance in three steps: no passwords for everyday sign-in, no password at enrollment and weaning existing customers off passwords. Dhaval Shah (Director of Product, Identity, Capital One) said at Authenticate 2026 that passkey usage on web rose from 12% to 65%. Moving passkey registration into account opening doubled registrations.

Source: Dhaval Shah and Sujeet Sinha (Capital One), Authenticate 2026

The usage jump came from the login screen. Capital One hid "Sign in with passkey" for users without a passkey and added Conditional UI autofill plus an autoprompt that opens the passkey dialog on page load. Rollouts went in 1% to 5% increments with a kill switch that reverts a release in under 15 minutes.

Source: Dhaval Shah (Capital One), Authenticate 2026

7. Which Signals tell you a User is ready for Password Removal?#

A user is ready for password removal when they use passkeys consistently, have a backup method and do not hit passkey failures on the devices they use. Speakers at Authenticate 2026 named concrete signals. Meta checks for a recovery method or second secure method. Mercari disables the password as soon as a passkey exists. eBay's data shows why device coverage matters before switching anything off.

• Passkey coverage must hold on every device the user owns: Manisa Mondal (Senior Product Manager, eBay) reported that passkeys now cover 25% of all eBay sign-ins, up from 15% a year earlier. Coverage varies widely: 57% on iOS, 34% on Android and 14% on desktop web. In eBay's survey of more than 8,000 users, 7 in 10 switch devices, and cross-device problems were the top reason users stopped using passkeys.
• Stale passkeys must not cause repeated failures: eBay's passkey sign-in success is 93%, with about 95% of failures caused by stale passkeys. Removing passwords for users who regularly hit stale passkeys would lock them out. eBay fixes this with the WebAuthn Signal API.
• The passkey must come first in the flow: The FIDO Passkey Index found that 2 participants still show a password or OTP before the passkey. One estimates that passkey-first would roughly double its passkey sign-in share.
• Edge cases need a path before the password goes: Mercari's Tatsuya Karino named users with no valid email and no verified attributes. Without a password, they could only reach customer support. Test accounts are another edge case.

Source: Manisa Mondal and Ilangovan Vairakkalai (eBay), Authenticate 2026

Corbado's Passkey Benchmark 2026 shows the same device effect: on a recognized device, passkey logins succeed 95% to 99% of the time. On an unrecognized desktop the rate drops to 55% to 70%, and 35% to 50% of successful logins there need a phone via cross-device authentication (Passkey Benchmark 2026).

8. How do Enterprises remove Passwords for their Employees?#

Enterprises remove workforce passwords, meaning the passwords of their own employees, through staged, group-based waves and policy enforcement. General Motors moved more than 200,000 workforce users in 19 waves. Microsoft enforces phishing-resistant-only sign-in for all its employees and will retire native SMS and voice delivery in Microsoft Entra on 1 February 2027.

This section covers workforce authentication. The cases above (Mercari, Meta, PayPal and Capital One) remove passwords for consumers. The approach differs because employers control devices, policies and onboarding, while consumer services do not.

8.1 General Motors#

Andrew Cameron (Distinguished Engineer, Cybersecurity, GM) and Nick LewAllen (Sr. Identity Engineer, Cybersecurity, GM) first moved MFA enforcement from ADFS to Entra Conditional Access in 8 waves. They then switched users to cloud authentication and passkeys in 11 waves from February 2025 to February 2026.

Around 100,000 users are on managed devices, where Windows Hello and Platform SSO satisfy a passkey policy. Plant workers who cannot carry phones needed other methods. SMS OTP was deprecated as an MFA method on the way. Their main lesson: design for the exceptions first.

8.2 Microsoft#

Marina Sanchez (Product Manager, Microsoft) said Microsoft reached 99.9% phishing-resistant authentication in its workforce by removing phishable credentials. Hana Kim (Senior Product Manager, Microsoft) reported that system-preferred authentication raised passkey sign-ins across the Entra user base by 380%. According to Sangeeta Ranjit (Principal Lead PM, Microsoft), Microsoft has started eliminating passwords at account creation for consumers and plans the same for Entra. Our Entra passkeys guide covers the setup.

9. How Corbado can help#

Every case in this article removed passwords only after the data showed it was safe. Mercari watched password reliance fall from 75% to 22%, Meta checks for a recovery method per user and Capital One gated each release with KPIs and a kill switch. Most teams cannot see these signals today, because their identity provider reports logins and not which method a user really relies on. Corbado Observe, the authentication observability layer, adds that view on top of the existing login, with no passkey programme required to start.

Login Methods shows passkey, password and OTP side by side over time, so password reliance becomes a share of your traffic you can track like Mercari did. Technology splits every login and enrollment by OS, OS version and browser, and Device Health classifies ceremony outcomes per device brand and model. That answers eBay's question of whether passkeys hold on every device before the password goes. Passkey Errors attributes failed ceremonies to a WebAuthn reason, so stale passkeys and cross-device problems show up before they turn into lockouts. Authenticator Inventory counts synced and device-bound credentials apart, which matters when a user loses a device.

See how Corbado Connect ships this →

Once the data shows which users are ready, Corbado Connect acts on it. Its components are built around the identifier-first approach, the same pattern Mercari used to decide per account which factors to offer. Passkey Intelligence decides on passkey availability from the client environment and the existing passkeys of that user. Rollout Rules gate passkey creation and login per client, and every rule ends in allow, block or allow with sampling. A ruleset can be replayed against recorded traffic before it takes effect. A project-level kill switch drops passkey login, append and management into fallback in one move, with no app store update in the loop, which covers the safety net Capital One built for its own rollout.

10. Conclusion#

Authenticate 2026 delivered the first broad case data on removing passwords. Mercari cut password reliance from 75% to 22% and password sign-ups to about 1%, starting at sign-up and disabling the password per user based on signals. The FIDO Passkey Index counts 9 of 13 relying parties planning passwordless accounts within 12 months, with passkeys at 36% of sign-ins and a 93% success rate. Meta adds friction to password logins before it removes them, PayPal closes phishable fallbacks and Capital One gates every release with small increments and a kill switch. GM shows that more than 200,000 workforce users can move in repeatable waves when the exceptions are designed first.

About Corbado

Corbado is the Passkey Intelligence Platform for large-scale CIAM teams running consumer authentication. We help you see what IDP logs and generic analytics tools can't: where passkeys, passwords, OTP, social login and fallback journeys succeed, stall or fail, which devices and browsers create friction, and when an OS update silently breaks login. Two products: Corbado Observe layers process mining and observability across authentication journeys. Corbado Connect adds managed passkeys with analytics built in alongside your IDP. VicRoads runs passkeys for 5M+ users with Corbado (more than 80% passkey activation rate). Talk to a Passkey Expert →

Frequently Asked Questions#

How did Mercari remove passwords for existing users?#

Mercari disables passwords per account based on signals. Registering a passkey disables the password, a high risk score such as a residential proxy or VPN disables it for that login and detected account takeover revokes it. Automatic passkey upgrades after password-manager logins also remove the password. Password reliance at login fell from 75% to 22% in three years, Mercari reported at Authenticate 2026.

What share of companies plan passwordless accounts?#

According to the FIDO Passkey Index 2026, 9 of 13 responding relying parties plan to deploy passwordless accounts within 12 months, one of them on an exploratory basis. One more is researching the option and three have no plans yet. The Index is based on confidential data from 15 large consumer relying parties and was presented at Authenticate 2026.

Should passkeys be mandatory before passwords are removed?#

Meta's approach suggests yes: mandate passkey creation first and remove passwords later. Meta began requiring passkey creation for advertiser accounts in August 2026, without removing any passwords. It used a grace period of 14 to 30 days, repeated warnings and briefed support teams. Meta's Jason Cheung called the mandate relatively low friction overall, despite confusion about OS requirements. Password removal itself only follows once users have a passkey, use it everywhere and have a recovery method or second secure method.

Why do passkeys not stop account takeover while passwords remain?#

Passkeys protect only the sign-ins that use them. PayPal reported at Authenticate 2026 that it sees no phishing among passkey logins, yet attackers still take over accounts through SMS OTP and password fallbacks. They then register their own passkeys. Removing phishable fallbacks for passkey users is therefore required to turn passkey adoption into account takeover protection.

How long does an enterprise password removal take?#

General Motors needed about a year to move its workforce to cloud authentication and passkeys, running 11 waves from February 2025 to February 2026 after 8 earlier MFA migration waves. In total, 19 waves covered more than 200,000 users. GM's lessons were to design for exceptions first, get user data right before each cutover and communicate heavily through enterprise channels.