Passkey Index 2026: Why Usage lags Enrollment

1. Introduction#

More than one in three successful sign-ins at large consumer services now use a passkey. The FIDO Alliance Passkey Index 2026, presented by Diego Zavala (Director of Ecosystem Development, FIDO Alliance) at Authenticate 2026, puts the share at 36%, up from 26% a year earlier. Passkey sign-ins succeed 93% of the time, compared with 78% for passwords and MFA, and they save about 27 seconds per user.

The harder number sits underneath: in 8 of 10 reporting relying parties, the passkey sign-in share is below the enrollment rate. This article combines the Index with relying party data from eBay, Capital One, Mercari, Amazon, Meta, PayPal and Dashlane to show why enrollment does not automatically become usage and what closes the gap.

2. What does the FIDO Passkey Index 2026 measure?#

The FIDO Passkey Index 2026 aggregates confidential data from 15 large consumer relying parties. Figures are unattributed and unweighted averages. Because the participant group grew from 9 in 2025, every year-over-year comparison is directional only. The Index tracks eligibility, enrollment, the share of successful sign-ins that use a passkey, sign-in success, speed and, new in 2026, phishing impact and passwordless plans.

Source: Diego Zavala (FIDO Alliance) and Rakan Khalid (PayPal), Authenticate 2026

Diego Zavala stressed one definition at Authenticate 2026: "sign-in" includes reauthentication and similar flows but excludes account recovery. That matters when you benchmark. A relying party that counts recovery logins or only first-factor logins will get a different share.

The second definition is the denominator. Enrollment is reported against eligible accounts (42%) and all active accounts (38%). On average 90% of active accounts were eligible, slightly below 93% in 2025 due to a broader participant mix. Seven of 13 participants offer passkeys to their entire user base. For the metrics behind these definitions, see our guide to passkey analytics.

3. How big is the Gap between Passkey Enrollment and Passkey Usage?#

The enrollment-usage gap in the Passkey Index narrowed from about 8 points in 2025 (34% of accounts with a passkey vs. 26% of sign-ins) to 2 points in 2026 (38% vs. 36%). The gap is closing on average, but it has not closed. Among the 10 participants that reported both numbers, 8 still have a passkey sign-in share below their enrollment rate.

Source: Diego Zavala (FIDO Alliance) and Rakan Khalid (PayPal), Authenticate 2026

Relying party data at Authenticate 2026 shows how wide the gap can be in a single deployment:

• eBay reaches up to 50% opt-in, but only 25% of sign-ins use a passkey: Opt-in rates reach about 50% on mobile web, 45% on iOS and Android and 16% on desktop web, according to Manisa Mondal (Senior Product Manager, eBay). The passkey share of all eBay sign-ins is 25%, up from 15% a year ago. Our eBay passkeys analysis shows the flows.
• Few large relying parties exceed 16% passkey authentications: Among a sample of roughly the top 60 relying parties by authentication volume, only a handful had more than about 16% of authentications on passkeys, said Rew Islam (Director of Product Innovation, Dashlane).

Corbado's Passkey Benchmark 2026 scenario model shows the same gap: with optimized enrollment, 65% of passkey-ready users (89% of the audience) create a passkey, but only 40% of their logins use it, a passkey login rate of about 23%. Passkey-first return flows with 80% enrollment and 95% usage reach about 68% (Passkey Benchmark 2026).

4. Why do enrolled Users not sign in with their Passkey?#

Enrolled users skip their passkey mainly because the sign-in flow does not offer it first. Two Passkey Index participants still show a password or OTP before the passkey, even to users who have one, and one estimates that passkey-first would roughly double its passkey sign-in share. Stale credentials, device switching and low user awareness add further friction.

Speakers at Authenticate 2026 named four recurring causes:

• Password managers offer the saved password first: Sanyal Chincholikar (Sr. PM, Identity Services, Amazon) said password managers often suggest the password because it was the last method used.
• A passkey button confuses users without a passkey: At Capital One, users clicked a "Sign in with passkey" button before creating a passkey, while usage stayed flat for weeks, said Nidhin Benjamine (Senior Manager Software Engineering, Capital One).
• Most users forget they created a passkey: eBay surveyed more than 8,000 users in the US, UK and Germany. Only one in four enrolled users remembered creating an eBay passkey, and half of those who said they knew passkeys confused them with password managers or PINs.
• Device switching breaks the passkey flow: 7 in 10 eBay survey respondents switch devices, and cross-device problems are the top reason people stop. Alistair Thornton (Director, Product Management, Meta) said desktop and cross-device flows "perform a lot worse than the mobile-first flows".

5. Which Changes moved Passkey Usage the most?#

Making the passkey the default path moved usage most. Capital One lifted web adoption from 12% to 65% after hiding the passkey button for users without a passkey and adding autofill and an autoprompt. eBay grew the passkey share of sign-ins from 15% to 25% with conditional mediation on the username screen and auto-triggered passkey sign-in on recognized devices. Microsoft raised Entra passkey sign-ins by 380% with system-preferred authentication.

The details per relying party:

• Capital One made passkeys the preferred web sign-in with autofill and an autoprompt: Sujeet Sinha (Director of Software Engineering, Capital One) described autofill (Conditional UI) plus an autoprompt that fires the native dialog on page load when a discoverable passkey exists. After that change passkeys became the preferred sign-in for returning web customers.
• eBay reached 57% passkey sign-ins on iOS with conditional mediation: Ilangovan Vairakkalai (Senior Staff Engineer, eBay) explained conditional mediation on the username screen and a recognized-device screen that triggers authentication with that user's passkeys only. By platform, eBay now sees 57% passkey sign-ins on iOS, 34% on Android and 14% on desktop web.
• Amazon presses the passkey button automatically where autofill is missing: Amazon uses autofill on the username field and falls back to an automatic button press, said Sanyal Chincholikar. More detail is in our Amazon passkeys analysis.

Diego Zavala gave the same advice from the Index: put the passkey first with conditional UI and immediate mediation, both built on the W3C WebAuthn Level 3 specification. Our passkey login best practices cover the full flow.

6. How much better are Passkey Sign-in Success Rates and Speed?#

Passkey sign-ins succeed 93% of the time vs. 78% for passwords and traditional MFA, and they are 2.8x faster. That is a 15-point success gap in the 2026 Index. Passkeys were more successful at 11 of 12 relying parties and faster at all 9 that measured speed, saving about 27 seconds per user on average. The FIDO Alliance noted that relying parties measure time differently.

Source: Diego Zavala (FIDO Alliance) and Rakan Khalid (PayPal), Authenticate 2026

Relying parties confirmed the direction:

• Capital One authenticates almost 2x faster with passkeys: Passkey sign-in success was far higher than for passwords after the rollout to 100% of web customers, said Sujeet Sinha.
• Mercari raised login success by 13 points: The gain came between January and September 2026 after the move to passkeys and an identifier-first flow, said Tatsuya Karino (Engineer, Mercari). He did not share absolute numbers.
• eBay matches the Index with 93% passkey success: About 95% of its failures come from stale passkeys, covered in the next section.

Corbado's Passkey Benchmark 2026 shows how much passkey success depends on the platform. Identifier-first logins on an unrecognized device succeed 85% to 95% of the time on iOS web, 70% to 85% on Android and macOS web and 45% to 60% on Windows, where 40% to 65% of successful logins need a phone. On recognized devices, success rises to 95% to 99% (Passkey Benchmark 2026).

7. What are stale Passkeys and how do they hurt the Success Rate?#

A stale passkey is a credential that still sits in the user's credential manager after the relying party has deleted the matching public key. At eBay about 95% of failed passkey sign-ins come from stale passkeys, according to Ilangovan Vairakkalai. Removing them is one of the cheapest ways to push a passkey success rate above the Index average of 93%.

Source: Manisa Mondal and Ilangovan Vairakkalai (eBay), Authenticate 2026

eBay deletes server-side keys after password changes, resets and account takeovers. The private keys remain in Google, Apple or third-party managers and keep being offered. Early eBay telemetry showed 25 users causing 100 errors by retrying again and again.

eBay now uses three fixes:

• The Signal API removes invalid passkeys from the manager: It tells Chrome or Safari to delete an invalid passkey during the failed attempt, as documented on passkeys.dev and in our Signal API guide.
• A graceful fallback keeps the username: eBay reuses the username from passkey metadata so the user does not retype it.
• Failure-aware backoff stops retry loops: eBay suppresses conditional UI for a user and device after repeated failures.

WhatsApp described an alternative: keep a disabled state on the server and re-enable the passkey after the user signs in another way. Microsoft Password Manager also supports the Signal API, said Rakia Segev (Product Manager II, Microsoft).

8. Where should Passkey Enrollment happen to drive later Usage?#

Enrollment moments that lead to real usage are account creation, password reset and silent upgrades after a password login. Amazon found customers more likely to accept during account creation than after sign-in. Capital One doubled registrations by moving passkey creation into account opening. Amazon also reported that customers who received a passkey through conditional create use it more often than manual enrollees.

More than 150 million Amazon customers had a passkey in 2024 and more than 500 million today, said Sanyal Chincholikar. Mercari moved passkey creation into sign-up and cut password sign-ups from about half to about 1%. Our guides to passkey creation best practices and Conditional Create cover these enrollment moments in detail.

PayPal weighed intent against volume. Password reset converts best but has low volume. Checkout has volume, and about 30% to 40% of users who see the checkout opt-in try to enroll, said Rakan Khalid. PayPal accepted some checkout drop-off after a break-even analysis with a three- to four-month payback.

Meta account passkeys grew from a January 2026 start to more than 100 million, said Alistair Thornton. Jason Cheung (Product Marketing Manager, Meta) added that most were created after login and at app open, and the app-open upsell showed no regression in top-line growth metrics. WhatsApp has more than 1 billion passkeys, as described in our WhatsApp passkeys analysis.

9. What Business Impact does the Passkey Index report beyond Sign-in?#

Beyond success and speed, the Passkey Index 2026 reports lower phishing, fewer account takeovers and lower SMS costs. All 8 respondents to the new phishing question saw fewer successful phishing attacks. Four participants shared SMS OTP savings from about $1 million to hundreds of millions of dollars per year. Three reported fewer account takeovers, one with virtually none among passkey users.

PayPal added engagement to the business case. Rakan Khalid said checkout and P2P transactions convert better, and the biggest engagement lift comes from PayPal's least-engaged customer tier.

Rakan Khalid also named the limit: attackers still take over accounts through phishable fallbacks such as SMS OTP and passwords, then register their own passkeys. At Mercari, the share of users relying on passwords fell from 75% three years ago to 22%, and 41.2% now use passkeys, said Tatsuya Karino.

For a structured way to turn these effects into a projection, see our passkey business case guide and the breakdown of SMS OTP costs.

10. Is Passwordless the next Step after Passkey Usage?#

Passwordless accounts are the next step for most Index participants. Nine of 13 respondents plan to deploy passwordless accounts within 12 months, one of them on an exploratory basis. One more is researching and three have no plans. Diego Zavala gave two reasons: passwordless removes phishable fallbacks and it makes sure users actually use the passkey they already have.

Relying parties are moving in steps. PayPal plans to test access with phishing-resistant authenticators only within weeks of Authenticate 2026. Meta is testing removal of phishable methods at 2FA, login challenges and recovery for consistent passkey users. Mercari already disables passwords per user once a passkey is registered. We cover these cases in our article on removing passwords with real case data.

11. How Corbado can help#

The Passkey Index measures exactly what most teams cannot see in their own stack: the share of successful sign-ins that use a passkey, next to enrollment, success rate and speed. Identity providers usually report logins and registrations, so the gap between 38% enrollment and 36% usage stays invisible until someone builds the analysis by hand. Corbado Observe, the authentication observability layer, adds these metrics on top of your existing login, with no passkey programme required to start.

Login Methods shows passkey, password and OTP side by side over time, which is the passkey sign-in share the Index reports. Passkey Enrollment reports enrollment ceremonies filterable by application, OS and browser and records the completion type, so a silent upgrade through Conditional Create separates from a prompt a user accepted. Technology splits every login and enrollment by OS, OS version and browser, which turns eBay's split of 57% on iOS and 14% on desktop web into a number per cohort for your own users. Passkey Errors attributes failed ceremonies to a WebAuthn reason, and Observe reports Signal API support as a client capability, so you can see what share of your traffic can clean up stale passkeys at all.

See Login Methods in Corbado Observe →

To close the gap, Corbado Connect adds passkey-first flows to the identity stack you already run. Its components are built around the identifier-first approach, and Passkey Intelligence decides on passkey availability from the client environment and the existing passkeys of that user, so the passkey comes first only where it will work. The passkey list component calls signalAllAcceptedCredentials() after a deletion and implements signalUnknownCredential, which addresses the stale-passkey failures behind most of eBay's errors. Rollout Rules gate passkey creation and login per client, so a cohort that does not perform yet keeps its current flow.

12. Conclusion#

The FIDO Passkey Index 2026 shows passkeys in everyday use: 36% of successful sign-ins, about 27 seconds saved per user and 93% success vs. 78% for passwords and MFA. The enrollment-usage gap shrank from 8 points to 2, yet 8 of 10 reporting relying parties still have usage below enrollment. Relying parties that moved usage the most, like Capital One (12% to 65% on web) and eBay (15% to 25% of sign-ins), made the passkey the default path, removed stale credentials and enrolled users at high-intent moments such as account creation, password reset and Conditional Create. The next step is passwordless accounts, which 9 of 13 participants plan within 12 months. Teams should track the passkey share of sign-ins instead of passkey counts, because that number shows real value.

About Corbado

Corbado is the Passkey Intelligence Platform for large-scale CIAM teams running consumer authentication. We help you see what IDP logs and generic analytics tools can't: where passkeys, passwords, OTP, social login and fallback journeys succeed, stall or fail, which devices and browsers create friction, and when an OS update silently breaks login. Two products: Corbado Observe layers process mining and observability across authentication journeys. Corbado Connect adds managed passkeys with analytics built in alongside your IDP. VicRoads runs passkeys for 5M+ users with Corbado (more than 80% passkey activation rate). Talk to a Passkey Expert →

Frequently Asked Questions#

What share of sign-ins use passkeys in 2026?#

According to the FIDO Alliance Passkey Index 2026, presented at Authenticate 2026, 36% of successful sign-ins at 15 large consumer relying parties used a passkey. That is up from 26% in 2025. The figure includes reauthentication but excludes account recovery. Because the participant group changed, the FIDO Alliance treats the year-over-year comparison as directional only.

What is the passkey sign-in success rate compared with passwords?#

The Passkey Index 2026 reports an average passkey sign-in success rate of 93%, compared with 78% for passwords and traditional MFA. Passkeys had higher success at 11 of 12 reporting relying parties. eBay reported exactly 93% at Authenticate 2026, and about 95% of its passkey failures came from stale passkeys that the Signal API can remove.

Why is passkey usage lower than passkey enrollment?#

Usage lags enrollment mainly because sign-in flows show a password or OTP before the passkey, users forget they created one and device switching breaks the flow. In the 2026 Index, 8 of 10 reporting relying parties had usage below enrollment. eBay found that only one in four enrolled users remembered creating an eBay passkey.

How many relying parties plan passwordless accounts?#

Nine of 13 Passkey Index 2026 respondents plan passwordless accounts within the next 12 months, one of them on an exploratory basis. One more is researching and three have no plans yet. The FIDO Alliance sees passwordless as the way to remove phishable fallbacks, which PayPal named as the main remaining account takeover path.