Facebook Passkeys: Launch Analysis & Meta's Strategy

1. Introduction: Facebook Passkeys#

Just a few months after passkeys were rolled out for WhatsApp, Meta has officially announced the launch of passkeys for Facebook. This is a major step towards more secure and convenient authentication for millions of users worldwide. The rollout has started for the Facebook mobile apps on iOS and Android, with support for Messenger planned to follow in the coming months.

2. How to set up your Facebook Passkey#

You can enable your passkey in the "Accounts Center" within Facebook's settings menu. The process is straightforward, but there are a few things to note based on our initial tests and your platform:

• Step-up Authentication: You may be required to re-enter your password before creating a passkey. We observed this on Android when already logged into the app. This is a security measure to ensure it's really you.
• Initial Login: On iOS, we had to perform a fresh login with a password before the option to create a passkey became available.

Once set up, your passkey uses your device's native biometric authentication—like Face ID, Touch ID, or fingerprint sensors—for a seamless login experience.

4. Key Considerations and Limitations#

While the launch is a huge step forward, there are some limitations to be aware of:

4.1 One Passkey per Account#

Currently, Facebook only allows you to create a single passkey for your account. This can be a significant drawback for users who rely on multiple devices or use different credential managers (e.g. storing one passkey in iCloud Keychain and another in 1Password). This limitation may pose a challenge for users who need cross-platform flexibility.

4.2 Mobile-First Rollout#

The initial rollout is focused on the Facebook mobile apps for iOS and Android. While this covers the majority of users, desktop users will have to wait for full support. Traditional login methods, including passwords and two-factor authentication, will continue to work on all platforms.

5. The Bigger Picture of Passkeys at Meta#

The introduction of passkeys on Facebook is part of Meta's broader strategy to enhance security across its ecosystem. The same passkey created for Facebook will eventually work for Messenger, simplifying the user experience.

Meta also plans to integrate passkeys with other services, such as:

• Meta Pay: Securely autofill payment information for purchases.
• Encrypted Backups: Protect your encrypted message history in Messenger.

This follows the path of other major tech companies like Google, Amazon, and TikTok that have successfully rolled out passkeys, signaling a strong industry-wide shift away from passwords.

6. Passkeys at Instagram#

Instagram does not yet have passkey support. However, some X users found the first assets (in this case images) for a passkey support at Instagram:

This indicates that Meta probably wants to take the learnings from Facebook's passkey rollout to Instagram's passkey rollout.

7. Conclusion: Facebook Passkeys#

The rollout of passkeys on Facebook is a pivotal moment for passwordless authentication. By bringing this technology to its massive user base, Meta is significantly accelerating the adoption of a more secure standard for the web. While there are current limitations, such as the single-passkey rule, this is a promising start.

About Corbado

Corbado is the Passkey Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: which devices, OS versions, browsers and credential managers support passkeys, why enrollments don't turn into logins, where the WebAuthn flow fails and when an OS / browser update silently breaks login, all without replacing Okta, Auth0, Ping, Cognito or your in-house IDP. Two products: Corbado Observe layers observability for passkeys and any other login method. Corbado Connect adds managed passkeys with analytics built in (alongside your IDP). VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →

Frequently Asked Questions#

How do I set up a passkey on Facebook?#

You can enable a passkey in the Accounts Center within Facebook's settings menu on iOS or Android. On Android when already logged in, you may be prompted to re-enter your password as a security step; on iOS, a fresh login may be required before the option appears. Once created, your device's biometric authentication like Face ID or a fingerprint sensor handles future logins.

What are the current limitations of Facebook passkeys?#

Facebook currently limits each account to a single passkey, which is a drawback for users who rely on multiple devices or credential managers like iCloud Keychain or 1Password. The rollout is also mobile-only at launch, meaning desktop users must continue using passwords or two-factor authentication until full support arrives.

Will the same Facebook passkey work on Messenger and Instagram?#

Meta has confirmed that the passkey created for Facebook will eventually work for Messenger, simplifying authentication across those two services. Instagram does not yet support passkeys, but leaked app assets suggest Meta is planning an Instagram rollout informed by the lessons learned from Facebook's launch.

How does Meta plan to use passkeys beyond account login?#

Meta plans to integrate passkeys with Meta Pay for secure payment information autofill and with encrypted Messenger backups to protect message history. This positions passkeys as a broader authentication layer across Meta's ecosystem rather than a simple password replacement for login alone.