Passkeys are about a third of sign-ins, the 2026 index says

The FIDO Alliance’s Passkey Index for 2026 says that, across the consumer services that contributed, 36% of successful sign-ins used a passkey. A year earlier the same kind of index put that share at 26%. The number is real, and it is narrower than “a third of the internet.”

FIDO published the index on October 15, 2026. It is a survey of companies that already offer passkeys, not a census of all accounts.

What was measured

The index page and the PDF describe the method in the first pages. Fifteen consumer services, which FIDO calls relying parties, submitted confidential figures. No number is tied to a named company. Results were compiled on September 21, 2026. Percentages are unweighted averages of the organizations that answered that question. Not every organization answered every question, so each figure has its own count.

The 36% is the average passkey share of successful sign-ins, from 12 organizations. FIDO says that share includes signing in again during a session and excludes account recovery. It only covers services that offer a passkey as a way to sign in. Last year’s index had 9 organizations and reported 26%. FIDO says the comparison is directional: this year’s group against last year’s group, not the same companies measured twice.

Enrollment moved less than use. Among organizations that reported both, the share of accounts with a passkey went from 34% in the 2025 index to 38% in this one, while the sign-in share went from 26% to 36%. The gap between “has a passkey” and “used a passkey” shrank from about 8 points to about 2. FIDO’s reading is that people who already had a passkey used it more often. Eight of ten organizations in that comparison still see a sign-in share below their enrollment rate, which FIDO reads as people who have a passkey but are not always offered it, or not always able to use it, at the sign-in screen.

Two other averages, from the organizations that measure them: passkey sign-ins succeeded 93% of the time, against 78% for traditional multi-factor sign-ins, and a passkey sign-in was nearly three times faster, saving 27 seconds on average. Every participant that measures phishing said successful phishing attacks had fallen since they deployed passkeys. Every participant that provided cost data said SMS one-time-password costs had fallen. Those are reports from the participants who track the thing, not a count of attacks or a dollar figure FIDO is willing to attach to a name.

What the index does not say

It does not say that 36% of your accounts have a passkey. It does not say passwords are gone. It does not say a passkey cannot be phished in some other way; it says the organizations that measure phishing reported fewer successful attacks after they turned passkeys on. A single organization’s anecdote in the “in practice” section of the PDF is that organization’s number. FIDO says those examples use different metrics and cannot be averaged or tied back to the 36%.

The index also does not tell you which of the 15 services is which. Guessing from a logo on someone else’s slide is not in the document.

What to do with it

1. If a service you already use offers a passkey, turn it on and then actually use it. The index’s own story is that enrollment moved slowly and use caught up. A passkey that exists but is never offered at sign-in does not change the 36%. When the site lets you prefer the passkey, do that.
2. Keep a second way in that is not a text-message code. The index treats falling SMS costs as a benefit to the company. For you, the benefit is not depending on a code that can be read by someone who has talked your carrier into moving the number. Our guide to locking down a Google or Apple account is the concrete version of that for the two accounts that unlock the others.
3. A passkey does not replace the cleanup after a breach. If a company already lost your password, adding a passkey now stops the next password phish. It does not unsend the old password. Change that one, and any other site where you reused it.

You do not need a new app, and you do not need to buy a hardware key for this result to apply to you. The passkeys in the index are the ones consumer services already ship, usually the one built into the phone or the computer.

Sources

• FIDO Alliance, Passkey Index 2026, October 15, 2026
• FIDO Alliance, Passkey Index (PDF), figures compiled September 21, 2026