Facebook Passkeys: Launch Analysis & Meta's Strategy

Just a few months after passkeys were rolled out for WhatsApp, Meta has officially announced the launch of passkeys for Facebook. This is a major step towards more secure and convenient authentication for millions of users worldwide. The rollout has started for the Facebook mobile apps on iOS and Android, with support for Messenger planned to follow in the coming months.

You can enable your passkey in the "Accounts Center" within Facebook's settings menu. The process is straightforward, but there are a few things to note based on our initial tests and your platform:

• Step-up Authentication: You may be required to re-enter your password before creating a passkey. We observed this on Android when already logged into the app. This is a security measure to ensure it's really you.
• Initial Login: On iOS, we had to perform a fresh login with a password before the option to create a passkey became available.

Once set up, your passkey uses your device's native biometric authentication—like Face ID, Touch ID, or fingerprint sensors—for a seamless login experience.

While the launch is a huge step forward, there are some limitations to be aware of:

Currently, Facebook only allows you to create a single passkey for your account. This can be a significant drawback for users who rely on multiple devices or use different credential managers (e.g. storing one passkey in iCloud Keychain and another in 1Password). This limitation may pose a challenge for users who need cross-platform flexibility.

The initial rollout is focused on the Facebook mobile apps for iOS and Android. While this covers the majority of users, desktop users will have to wait for full support. Traditional login methods, including passwords and two-factor authentication, will continue to work on all platforms.

The introduction of passkeys on Facebook is part of Meta's broader strategy to enhance security across its ecosystem. The same passkey created for Facebook will eventually work for Messenger, simplifying the user experience.

Meta also plans to integrate passkeys with other services, such as:

• Meta Pay: Securely autofill payment information for purchases.
• Encrypted Backups: Protect your encrypted message history in Messenger.

This follows the path of other major tech companies like Google, Amazon, and TikTok that have successfully rolled out passkeys, signaling a strong industry-wide shift away from passwords.

Instagram does not yet have passkey support. However, some X users found the first assets (in this case images) for a passkey support at Instagram:

This indicates that Meta probably wants to take the learnings from Facebook's passkey rollout to Instagram's passkey rollout.

The rollout of passkeys on Facebook is a pivotal moment for passwordless authentication. By bringing this technology to its massive user base, Meta is significantly accelerating the adoption of a more secure standard for the web. While there are current limitations, such as the single-passkey rule, this is a promising start.