---
url: 'https://www.corbado.com/blog/passkey-index-2026-enrollment-vs-usage'
title: 'Passkey Index 2026: Why Usage lags Enrollment'
description: 'FIDO Passkey Index 2026: 36% of sign-ins use passkeys, 93% success vs. 78%. Plus eBay, Capital One, Mercari and Amazon data on closing the usage gap.'
lang: 'en'
author: 'Vincent Delitz'
date: '2026-10-29T13:48:40.632Z'
lastModified: '2026-10-30T07:00:47.641Z'
keywords: 'passkey index 2026, passkey usage rate, passkey sign-in success rate, passkey enrollment vs usage, passkey adoption 2026'
category: 'Passkeys Strategy'
---

# Passkey Index 2026: Why Usage lags Enrollment

## Key Facts

- **36% of successful sign-ins** at 15 large consumer relying parties used a passkey in
  2026, up from 26% in 2025, according to the FIDO Alliance Passkey Index 2026.
- **42% of eligible accounts and 38% of all active accounts have a passkey**, while 90% of
  active accounts are eligible.
- The gap between enrollment and usage **shrank from 8 points to 2 points**, but 8 of 10
  reporting relying parties still see usage below enrollment.
- Passkey sign-ins **succeed 93% of the time vs. 78%** for passwords and traditional MFA.
- Passkey sign-in is **2.8x faster** and saves about 27 seconds per user on average.
- **All 8 relying parties that answered report fewer successful phishing attacks** since
  deploying passkeys.
- **9 of 13 respondents plan passwordless accounts** within 12 months.

## 1. Introduction

More than one in three successful sign-ins at large consumer services now use a passkey.
The [FIDO Alliance](https://www.corbado.com/glossary/fido-alliance) Passkey Index 2026, presented by Diego Zavala
(Director of Ecosystem Development, [FIDO Alliance](https://www.corbado.com/glossary/fido-alliance)) at
[Authenticate 2026](https://www.corbado.com/blog/android-restore-credentials-zero-tap-sign-in), puts the share at
36%, up from 26% a year earlier. Passkey sign-ins succeed 93% of the time, compared with
78% for passwords and MFA, and they save about 27 seconds per user.

The harder number sits underneath: in 8 of 10 reporting relying parties, the passkey
sign-in share is below the enrollment rate. This article combines the Index with
[relying party](https://www.corbado.com/glossary/relying-party) data from [eBay](https://www.corbado.com/blog/ebay-passkeys), Capital
One, Mercari, Amazon, Meta, [PayPal](https://www.corbado.com/blog/paypal-passkeys) and
[Dashlane](https://www.corbado.com/blog/dashlane-passkeys) to show why enrollment does not automatically become
usage and what closes the gap.

## 2. What does the FIDO Passkey Index 2026 measure?

The FIDO Passkey Index 2026 aggregates confidential data from 15 large consumer relying
parties. Figures are unattributed and unweighted averages. Because the participant group
grew from 9 in 2025, every year-over-year comparison is directional only. The Index tracks
eligibility, enrollment, the share of successful sign-ins that use a passkey, sign-in
success, speed and, new in 2026, [phishing](https://www.corbado.com/glossary/phishing) impact and passwordless
plans.

![FIDO Passkey Index 2026 key figures: 36% passkey sign-in share, 93% sign-in success, 27 seconds saved and 9 of 13 planning passwordless accounts](https://www.corbado.com/website-assets/authenticate_2026_passkey_index_key_figures_bc3a6d5e7c.jpg)

_Source: Diego Zavala (FIDO Alliance) and Rakan Khalid (PayPal), Authenticate 2026_

Diego Zavala stressed one definition at
[Authenticate 2026](https://www.corbado.com/blog/android-restore-credentials-zero-tap-sign-in): "sign-in"
includes reauthentication and similar flows but excludes account recovery. That matters
when you benchmark. A [relying party](https://www.corbado.com/glossary/relying-party) that counts recovery logins
or only first-factor logins will get a different share.

The second definition is the denominator. Enrollment is reported against eligible accounts
(42%) and all active accounts (38%). On average 90% of active accounts were eligible,
slightly below 93% in 2025 due to a broader participant mix. Seven of 13 participants
offer passkeys to their entire user base. For the metrics behind these definitions, see
our guide to [passkey analytics](https://www.corbado.com/blog/passkey-analytics).

## 3. How big is the Gap between Passkey Enrollment and Passkey Usage?

The enrollment-usage gap in the Passkey Index narrowed from about 8 points in 2025 (34% of
accounts with a passkey vs. 26% of sign-ins) to 2 points in 2026 (38% vs. 36%). The gap is
closing on average, but it has not closed. Among the 10 participants that reported both
numbers, 8 still have a passkey sign-in share below their enrollment rate.

![Gap between passkey enrollment and passkey sign-in share in the FIDO Passkey Index 2025 and 2026](https://www.corbado.com/website-assets/authenticate_2026_passkey_index_enrollment_usage_gap_0384536114.jpg)

_Source: Diego Zavala (FIDO Alliance) and Rakan Khalid (PayPal), Authenticate 2026_

[Relying party](https://www.corbado.com/glossary/relying-party) data at
[Authenticate 2026](https://www.corbado.com/blog/android-restore-credentials-zero-tap-sign-in) shows how wide the
gap can be in a single deployment:

- **eBay reaches up to 50% opt-in, but only 25% of sign-ins use a passkey:** Opt-in rates
  reach about 50% on mobile web, 45% on [iOS](https://www.corbado.com/blog/webauthn-errors) and
  [Android](https://www.corbado.com/blog/how-to-enable-passkeys-android) and 16% on desktop web, according to
  Manisa Mondal (Senior Product Manager, [eBay](https://www.corbado.com/blog/ebay-passkeys)). The passkey share
  of all [eBay](https://www.corbado.com/blog/ebay-passkeys) sign-ins is 25%, up from 15% a year ago. Our
  [eBay passkeys analysis](https://www.corbado.com/blog/ebay-passkeys) shows the flows.
- **Few large relying parties exceed 16% passkey authentications:** Among a sample of
  roughly the top 60 relying parties by authentication volume, only a handful had more
  than about 16% of authentications on passkeys, said Rew Islam (Director of Product
  Innovation, [Dashlane](https://www.corbado.com/blog/dashlane-passkeys)).

Corbado's [Passkey Benchmark 2026](https://www.corbado.com/blog/world-passkey-day-passkey-benchmark-2026)
scenario model shows the same gap: with optimized enrollment, 65% of passkey-ready users
(89% of the audience) [create a passkey](https://www.corbado.com/blog/passkey-creation-best-practices), but only
40% of their logins use it, a [passkey login rate](https://www.corbado.com/kpi/passkey-usage-rate) of about 23%.
Passkey-first return flows with 80% enrollment and 95% usage reach about 68%
([Passkey Benchmark 2026](https://www.corbado.com/blog/world-passkey-day-passkey-benchmark-2026)).

## 4. Why do enrolled Users not sign in with their Passkey?

Enrolled users skip their passkey mainly because the sign-in flow does not offer it first.
Two Passkey Index participants still show a password or OTP before the passkey, even to
users who have one, and one estimates that passkey-first would roughly double its passkey
sign-in share. Stale credentials, device switching and low user awareness add further
friction.

Speakers at Authenticate 2026 named four recurring causes:

- **Password managers offer the saved password first:** Sanyal Chincholikar (Sr. PM,
  Identity Services, Amazon) said password managers often suggest the password because it
  was the last method used.
- **A passkey button confuses users without a passkey:** At Capital One, users clicked a
  "Sign in with passkey" button before creating a passkey, while usage stayed flat for
  weeks, said Nidhin Benjamine (Senior Manager Software Engineering, Capital One).
- **Most users forget they created a passkey:** eBay surveyed more than 8,000 users in the
  US, UK and Germany. Only one in four enrolled users remembered creating an eBay passkey,
  and half of those who said they knew passkeys confused them with password managers or
  PINs.
- **Device switching breaks the passkey flow:** 7 in 10 eBay survey respondents switch
  devices, and cross-device problems are the top reason people stop. Alistair Thornton
  (Director, Product Management, Meta) said desktop and
  [cross-device flows](https://www.corbado.com/blog/webauthn-cross-device-authentication-passkeys-mobile-first)
  "perform a lot worse than the mobile-first flows".

## 5. Which Changes moved Passkey Usage the most?

Making the passkey the default path moved usage most. Capital One lifted web adoption from
12% to 65% after hiding the [passkey button](https://www.corbado.com/blog/passkey-login-best-practices) for users
without a passkey and adding autofill and an autoprompt. eBay grew the passkey share of
sign-ins from 15% to 25% with
[conditional mediation](https://www.corbado.com/blog/webauthn-conditional-ui-passkeys-autofill) on the username
screen and auto-triggered passkey sign-in on recognized devices. Microsoft raised Entra
passkey sign-ins by 380% with system-preferred authentication.

The details per relying party:

- **Capital One made passkeys the preferred web sign-in with autofill and an autoprompt:**
  Sujeet Sinha (Director of Software Engineering, Capital One) described autofill
  ([Conditional UI](https://www.corbado.com/glossary/conditional-ui)) plus an autoprompt that fires the native
  dialog on page load when a discoverable passkey exists. After that change passkeys
  became the preferred sign-in for returning web customers.
- **eBay reached 57% passkey sign-ins on iOS with conditional mediation:** Ilangovan
  Vairakkalai (Senior Staff Engineer, eBay) explained
  [conditional mediation](https://www.corbado.com/blog/webauthn-conditional-ui-passkeys-autofill) on the username
  screen and a recognized-device screen that triggers authentication with that user's
  passkeys only. By platform, eBay now sees 57% passkey sign-ins on
  [iOS](https://www.corbado.com/blog/webauthn-errors), 34% on [Android](https://www.corbado.com/blog/how-to-enable-passkeys-android) and
  14% on desktop web.
- **Amazon presses the passkey button automatically where autofill is missing:** Amazon
  uses autofill on the username field and falls back to an automatic button press, said
  Sanyal Chincholikar. More detail is in our
  [Amazon passkeys analysis](https://www.corbado.com/blog/amazon-passkeys).

Diego Zavala gave the same advice from the Index: put the passkey first with
[conditional UI](https://www.corbado.com/glossary/conditional-ui) and
[immediate mediation](https://www.corbado.com/blog/webauthn-immediate-mediation), both built on the
[W3C WebAuthn Level 3 specification](https://www.w3.org/TR/webauthn-3/). Our
[passkey login best practices](https://www.corbado.com/blog/passkey-login-best-practices) cover the full flow.

## 6. How much better are Passkey Sign-in Success Rates and Speed?

**Passkey sign-ins succeed 93% of the time vs. 78% for passwords and traditional MFA, and
they are 2.8x faster.** That is a 15-point success gap in the 2026 Index. Passkeys were
more successful at 11 of 12 relying parties and faster at all 9 that measured speed,
saving about 27 seconds per user on average. The [FIDO Alliance](https://www.corbado.com/glossary/fido-alliance)
noted that relying parties measure time differently.

| **Metric (FIDO Passkey Index 2026)** | **Passkeys**    | **Passwords and traditional MFA** |
| ------------------------------------ | --------------- | --------------------------------- |
| Sign-in success rate                 | **93%**         | 78%                               |
| Relative speed                       | **2.8x faster** | Baseline                          |
| Average time saved per user          | **27 seconds**  | -                                 |

![Passkey sign-in success of 93% versus 78% for passwords and traditional MFA, with 2.8x faster sign-in](https://www.corbado.com/website-assets/authenticate_2026_passkey_index_success_speed_4ab838f9c3.jpg)

_Source: Diego Zavala (FIDO Alliance) and Rakan Khalid (PayPal), Authenticate 2026_

Relying parties confirmed the direction:

- **Capital One authenticates almost 2x faster with passkeys:** Passkey sign-in success
  was far higher than for passwords after the rollout to 100% of web customers, said
  Sujeet Sinha.
- **Mercari raised login success by 13 points:** The gain came between January and
  September 2026 after the move to passkeys and an
  [identifier-first flow](https://www.corbado.com/faq/identifier-first-approach-passkey-login), said Tatsuya
  Karino (Engineer, Mercari). He did not share absolute numbers.
- **eBay matches the Index with 93% passkey success:** About 95% of its failures come from
  stale passkeys, covered in the next section.

Corbado's Passkey Benchmark 2026 shows how much passkey success depends on the platform.
Identifier-first logins on an unrecognized device succeed 85% to 95% of the time on
[iOS](https://www.corbado.com/blog/webauthn-errors) web, 70% to 85% on
[Android](https://www.corbado.com/blog/how-to-enable-passkeys-android) and macOS web and 45% to 60% on Windows,
where 40% to 65% of successful logins need a phone. On recognized devices, success rises
to 95% to 99% ([Passkey Benchmark 2026](https://www.corbado.com/blog/world-passkey-day-passkey-benchmark-2026)).

## 7. What are stale Passkeys and how do they hurt the Success Rate?

A stale passkey is a credential that still sits in the user's credential manager after the
relying party has deleted the matching public key. At eBay about 95% of failed passkey
sign-ins come from stale passkeys, according to Ilangovan Vairakkalai. Removing them is
one of the cheapest ways to push a passkey success rate above the Index average of 93%.

![eBay passkey sign-in outcomes with 93% success and about 95% of failures caused by invalid keys](https://www.corbado.com/website-assets/authenticate_2026_ebay_stale_passkeys_521980936a.jpg)

_Source: Manisa Mondal and Ilangovan Vairakkalai (eBay), Authenticate 2026_

eBay deletes server-side keys after password changes, resets and account takeovers. The
private keys remain in Google, Apple or third-party managers and keep being offered. Early
eBay telemetry showed 25 users causing 100 errors by retrying again and again.

eBay now uses three fixes:

- **The Signal API removes invalid passkeys from the manager:** It tells Chrome or Safari
  to delete an invalid passkey during the failed attempt, as documented on
  [passkeys.dev](https://passkeys.dev/) and in our
  [Signal API guide](https://www.corbado.com/blog/webauthn-signal-api).
- **A graceful fallback keeps the username:** eBay reuses the username from passkey
  metadata so the user does not retype it.
- **Failure-aware backoff stops retry loops:** eBay suppresses
  [conditional UI](https://www.corbado.com/glossary/conditional-ui) for a user and device after repeated
  failures.

[WhatsApp](https://www.corbado.com/blog/whatsapp-passkeys) described an alternative: keep a disabled state on the
server and re-enable the passkey after the user signs in another way. Microsoft
[Password Manager](https://www.corbado.com/blog/passkeys-vs-password-managers) also supports the Signal API, said
Rakia Segev (Product Manager II, Microsoft).

## 8. Where should Passkey Enrollment happen to drive later Usage?

Enrollment moments that lead to real usage are account creation,
[password reset](https://www.corbado.com/blog/password-reset-increase-customer-retention) and silent upgrades
after a password login. Amazon found customers more likely to accept during account
creation than after sign-in. Capital One doubled registrations by moving
[passkey creation](https://www.corbado.com/blog/passkey-creation-best-practices) into
[account opening](https://www.corbado.com/blog/digital-identity-verification). Amazon also reported that
customers who received a passkey through
[conditional create](https://www.corbado.com/blog/conditional-create-passkeys) use it more often than manual
enrollees.

More than 150 million Amazon customers had a passkey in 2024 and more than 500 million
today, said Sanyal Chincholikar. Mercari moved
[passkey creation](https://www.corbado.com/blog/passkey-creation-best-practices) into sign-up and cut password
sign-ups from about half to about 1%. Our guides to
[passkey creation best practices](https://www.corbado.com/blog/passkey-creation-best-practices) and
[Conditional Create](https://www.corbado.com/blog/conditional-create-passkeys) cover these enrollment moments in
detail.

[PayPal](https://www.corbado.com/blog/paypal-passkeys) weighed intent against volume.
[Password reset](https://www.corbado.com/blog/password-reset-increase-customer-retention) converts best but has
low volume. Checkout has volume, and about 30% to 40% of users who see the checkout opt-in
try to enroll, said Rakan Khalid. [PayPal](https://www.corbado.com/blog/paypal-passkeys) accepted some checkout
drop-off after a break-even analysis with a three- to four-month payback.

Meta account passkeys grew from a January 2026 start to more than 100 million, said
Alistair Thornton. Jason Cheung (Product Marketing Manager, Meta) added that most were
created after login and at app open, and the app-open upsell showed no regression in
top-line growth metrics. [WhatsApp](https://www.corbado.com/blog/whatsapp-passkeys) has more than 1 billion
passkeys, as described in our [WhatsApp passkeys analysis](https://www.corbado.com/blog/whatsapp-passkeys).

## 9. What Business Impact does the Passkey Index report beyond Sign-in?

Beyond success and speed, the Passkey Index 2026 reports lower
[phishing](https://www.corbado.com/glossary/phishing), fewer account takeovers and lower SMS costs. All 8
respondents to the new [phishing](https://www.corbado.com/glossary/phishing) question saw fewer successful
[phishing attacks](https://www.corbado.com/blog/3ds-authentication-failed). Four participants shared SMS OTP
savings from about $1 million to hundreds of millions of dollars per year. Three reported
fewer account takeovers, one with virtually none among passkey users.

PayPal added engagement to the [business case](https://www.corbado.com/blog/passkey-adoption-business-case).
Rakan Khalid said checkout and P2P transactions convert better, and the biggest engagement
lift comes from [PayPal's](https://www.corbado.com/blog/paypal-passkeys) least-engaged customer tier.

Rakan Khalid also named the limit: attackers still take over accounts through phishable
fallbacks such as SMS OTP and passwords, then register their own passkeys. At Mercari, the
share of users relying on passwords fell from 75% three years ago to 22%, and 41.2% now
use passkeys, said Tatsuya Karino.

For a structured way to turn these effects into a projection, see our
[passkey business case guide](https://www.corbado.com/blog/passkey-adoption-business-case) and the breakdown of
[SMS OTP costs](https://www.corbado.com/faq/why-are-sms-otps-costly-for-enterprises).

## 10. Is Passwordless the next Step after Passkey Usage?

[Passwordless accounts](https://www.corbado.com/blog/disable-passwords-case-studies-authenticate-2026) are the
next step for most Index participants. Nine of 13 respondents plan to deploy
[passwordless accounts](https://www.corbado.com/blog/disable-passwords-case-studies-authenticate-2026) within 12
months, one of them on an exploratory basis. One more is researching and three have no
plans. Diego Zavala gave two reasons: passwordless removes phishable fallbacks and it
makes sure users actually use the passkey they already have.

Relying parties are moving in steps. PayPal plans to test access with phishing-resistant
[authenticators](https://www.corbado.com/glossary/authenticator) only within weeks of Authenticate 2026. Meta is
testing removal of phishable methods at
[2FA](https://www.corbado.com/blog/psd2-passkeys/are-passkeys-two-factor-authentication), login challenges and
recovery for consistent passkey users. Mercari already disables passwords per user once a
passkey is registered. We cover these cases in our article on
[removing passwords with real case data](https://www.corbado.com/blog/disable-passwords-case-studies-authenticate-2026).

## 11. How Corbado can help

The Passkey Index measures exactly what most teams cannot see in their own stack: the
share of successful sign-ins that use a passkey, next to enrollment, success rate and
speed. Identity providers usually report logins and registrations, so the gap between 38%
enrollment and 36% usage stays invisible until someone builds the analysis by hand.
[Corbado Observe](https://www.corbado.com/observe), the
[authentication observability](https://www.corbado.com/blog/authentication-observability) layer, adds these
metrics on top of your existing login, with no passkey programme required to start.

[Login Methods](https://www.corbado.com/observe/login-methods) shows passkey, password and OTP side by side over
time, which is the passkey sign-in share the Index reports.
[Passkey Enrollment](https://www.corbado.com/blog/passkey-creation-best-practices) reports enrollment ceremonies
filterable by application, OS and browser and records the completion type, so a silent
upgrade through [Conditional Create](https://www.corbado.com/blog/conditional-create-passkeys) separates from a
prompt a user accepted. Technology splits every login and enrollment by OS, OS version and
browser, which turns [eBay's](https://www.corbado.com/blog/ebay-passkeys) split of 57% on iOS and 14% on desktop
web into a number per cohort for your own users. [Passkey Errors](https://www.corbado.com/observe/passkey-errors)
attributes failed ceremonies to a WebAuthn reason, and Observe reports
[Signal API support](https://www.corbado.com/blog/webauthn-l3-credential-manager-support) as a
[client capability](https://www.corbado.com/blog/webauthn-client-capabilities), so you can see what share of your
traffic can clean up stale passkeys at all.

[Video: Login methods](https://www.corbado.com/videos/features/login-methods.mp4) ([See Login Methods in Corbado Observe](https://www.corbado.com/observe/login-methods))

To close the gap, [Corbado Connect](https://www.corbado.com/connect) adds passkey-first flows to the identity
stack you already run. Its components are built around the
[identifier-first approach](https://www.corbado.com/faq/identifier-first-approach-passkey-login), and
[Passkey Intelligence](https://docs.corbado.com/corbado-connect/features/passkey-intelligence)
decides on [passkey availability](https://www.corbado.com/faq/are-passkeys-available) from the client environment
and the existing passkeys of that user, so the passkey comes first only where it will
work. The passkey list component calls `signalAllAcceptedCredentials()` after a deletion
and implements `signalUnknownCredential`, which addresses the stale-passkey failures
behind most of [eBay's](https://www.corbado.com/blog/ebay-passkeys) errors.
[Rollout Rules](https://www.corbado.com/faq/gradual-rollout-support-passkey-adoption) gate
[passkey creation](https://www.corbado.com/blog/passkey-creation-best-practices) and login per client, so a
cohort that does not perform yet keeps its current flow.

## 12. Conclusion

The FIDO Passkey Index 2026 shows passkeys in everyday use: 36% of successful sign-ins,
about 27 seconds saved per user and 93% success vs. 78% for passwords and MFA. The
enrollment-usage gap shrank from 8 points to 2, yet 8 of 10 reporting relying parties
still have usage below enrollment. Relying parties that moved usage the most, like Capital
One (12% to 65% on web) and eBay (15% to 25% of sign-ins), made the passkey the default
path, removed stale credentials and enrolled users at high-intent moments such as account
creation, [password reset](https://www.corbado.com/blog/password-reset-increase-customer-retention) and
Conditional Create. The next step is
[passwordless accounts](https://www.corbado.com/blog/disable-passwords-case-studies-authenticate-2026), which 9
of 13 participants plan within 12 months. Teams should track the passkey share of sign-ins
instead of passkey counts, because that number shows real value.

## Frequently Asked Questions

### What share of sign-ins use passkeys in 2026?

According to the FIDO Alliance Passkey Index 2026, presented at Authenticate 2026, 36% of
successful sign-ins at 15 large consumer relying parties used a passkey. That is up from
26% in 2025. The figure includes reauthentication but excludes account recovery. Because
the participant group changed, the FIDO Alliance treats the year-over-year comparison as
directional only.

### What is the passkey sign-in success rate compared with passwords?

The Passkey Index 2026 reports an average passkey sign-in success rate of 93%, compared
with 78% for passwords and traditional MFA. Passkeys had higher success at 11 of 12
reporting relying parties. eBay reported exactly 93% at Authenticate 2026, and about 95%
of its passkey failures came from stale passkeys that the Signal API can remove.

### Why is passkey usage lower than passkey enrollment?

Usage lags enrollment mainly because sign-in flows show a password or OTP before the
passkey, users forget they created one and device switching breaks the flow. In the 2026
Index, 8 of 10 reporting relying parties had usage below enrollment. eBay found that only
one in four enrolled users remembered creating an eBay passkey.

### How many relying parties plan passwordless accounts?

Nine of 13 Passkey Index 2026 respondents plan passwordless accounts within the next 12
months, one of them on an exploratory basis. One more is researching and three have no
plans yet. The FIDO Alliance sees passwordless as the way to remove phishable fallbacks,
which PayPal named as the main remaining account takeover path.