Here is a number that surprised me: more than 15 billion online accounts can now be opened without typing a password at all. Instead, they accept something called a passkey, and the industry group that tracks them estimates 5 billion passkeys were already in use worldwide as of May 2026.
If you have ever stood at the kitchen counter trying to remember whether your email password ends in an exclamation point or the year your first grandchild was born, this is good news for you. A passkey replaces all that memory work with the same simple motion you use to wake up your phone: a fingerprint, a glance at the camera, or a short PIN.
Today I will walk you through it, one small step at a time.
What a Passkey Is, in Plain English
Think of a passkey as a key that lives inside your phone or computer instead of on your key ring. When you visit a website where you have set one up, the site asks your device a simple question: do you hold the key for this account?
Your device answers yes, but only after you approve it with your fingerprint, your face, or the PIN you use to unlock the screen. There is nothing to remember, nothing to type, and nothing to write on a sticky note.
The system runs on a shared standard built by the FIDO Alliance, an industry group formed in July 2012 and launched publicly in February 2013, whose members include the biggest phone makers, banks, and shopping sites. Because they all agreed on one standard, a passkey works the same way almost everywhere.
By May 2026, the group counted about 5 billion passkeys in use and more than 15 billion accounts ready to accept them. One comforting detail: your fingerprint or face scan never leaves your device.
The website never sees it, stores it, or sends it anywhere.
Why Passwords Keep Letting Us Down
Passwords fail for a very human reason: there are too many of them, so we reuse the same few. One security research team at Cybernews studied 19 billion passwords exposed in data breaches between April 2024 and April 2025 and found that 94 percent of the passwords in that dataset were reused or duplicated.
That means when crooks crack one site, they try the same password everywhere else you shop and bank, and it often works. The damage shows up in the FIDO Alliance's 2026 survey of 11,000 people across ten countries: one in three said an account of theirs was compromised, or they received a breach notice, in just the past year.
In the United States that figure was 41 percent, well above Europe and most of Asia, though India was highest of all at 49 percent. Forgotten passwords cost us in smaller ways too.
In that same survey, 47 percent of people said they are likely to give up on a purchase or a sign-in when they cannot remember the password. A passkey cannot be reused, cannot be guessed, and cannot be forgotten, because there is nothing for you to carry in your head at all.
The Scam Protection Built Right In
This is the part I most want you to hear. In 2025, Americans age 60 and over filed 201,266 complaints with the FBI's Internet Crime Complaint Center and reported more than 7.7 billion dollars in losses, an average of about 38,500 dollars per victim.
The single most reported crime type for our age group was phishing and spoofing, with 48,064 complaints. That category covers fake emails, texts, calls, and look-alike websites that trick you into typing your password or reading a code over the phone.
Here is where a passkey helps. A passkey only works on the genuine website it was created for. If a scammer builds a convincing copy of your bank's site, your passkey simply will not respond to it.
And the passkey itself generates no code, so it gives a caller nothing new to demand. One honest caution: some sites still send a separate texted or emailed code as an extra check even after a passkey sign-in, and if your account keeps a password or other recovery methods as backups, scammers can go after those too.
So keep the old rule firmly in place: never read any code aloud to someone who calls you. The passkey locks its own door tight. Your job is to guard the other doors.
How to Set Up Your First Passkey
Setting up a passkey usually takes less than a minute, and you do not need to be a computer whiz. There are two common paths. First, many sites now offer a passkey right after you sign in the old way, with a message like, would you like to sign in faster next time?
Tap yes, confirm with your fingerprint, face, or PIN, and you are done. Second, you can go looking for it yourself: sign in to the account, open Settings, find the section called Security or Sign-in, and look for the word Passkeys.
Tap to create one and approve it the same way you unlock your phone. The payoff is real. In October 2025, the FIDO Alliance published results from nine large companies that had offered passkeys for one to three years.
Signing in with a passkey took 8.5 seconds on average, compared with 31.2 seconds for the other sign-in methods those companies offered, such as passwords with texted codes, email verification links, and social logins. Passkey sign-ins succeeded 93 percent of the time, while those other methods succeeded only 63 percent of the time.
Fewer failures means fewer lockouts and fewer frustrating reset emails.
What Happens if You Lose Your Phone
This is the worry I hear most often, and it is a fair one. The short answer: losing your phone does not have to mean losing your accounts, but it pays to know which kind of passkey you have.
Most passkeys created on a phone today are synced passkeys. They are stored and backed up by a password manager, usually the one built into your phone, and that manager may use a different account than the website you created the passkey for.
When you set up a replacement phone and sign in to that manager's account, your passkeys can be restored. The key word is can: you must meet the manager's own recovery requirements, and some ask for more than a recovery phone number or email, such as the screen passcode from your old phone, a special manager PIN, or approval from another trusted device.
Find out now, while everything works, which manager holds your passkeys and what it will ask for. Some passkeys are device-bound instead, such as those stored on a physical security key, and they never sync anywhere.
For those, the cure is a spare: create a passkey for the same account on a second device, such as your home computer. If a phone is stolen, the thief still faces your fingerprint, face, or PIN before any passkey will respond.
Where to Start: Your Email Comes First
You do not need to convert every account this week. Start with one, and make it your email. Here is why that order matters: when you reset a forgotten password anywhere else, the reset link lands in your email inbox.
That makes email the master key to your whole online life, and the account most worth protecting with the strongest lock available. The largest email providers all support passkeys now, and since May 2025 one major provider has made new accounts passwordless by default, offering several ways to sign in without a password, with passkeys among them.
After email, move to your bank, then your main shopping account, then your phone or cable account. You will be in good company. In the FIDO Alliance's 2026 survey, 75 percent of people had enabled a passkey on at least one account, up sharply from earlier years, and 49 percent said they use passkeys regularly whenever a site offers one.
Awareness has climbed from 39 percent of people in 2022 to 90 percent in 2026. The tide has turned, and this is a parade worth joining at your own pace.
Common Worries About Passkeys, and the Reality
| The worry | The reality |
|---|---|
| What if I lose my phone? | Synced passkeys can be restored on a replacement phone through the password manager that stores them, once you meet its recovery requirements, which may include your old phone's passcode or a manager PIN. Device-bound passkeys do not sync, so create a spare passkey on a second device. |
| Will the website see my fingerprint? | No. Your fingerprint or face scan never leaves your device. The site only gets a yes or no. |
| I am not good with technology. | Setup is two or three taps, and you approve it the same way you already unlock your phone. |
| What if a site does not offer passkeys? | You simply keep using your password there. Passkeys are added account by account, at your pace. |
| Can a caller trick me into giving mine away? | The passkey itself generates no code to read aloud and will not respond to fake copycat sites. But some sites still send a separate verification code as an extra check, and scammers can target passwords and codes you still keep, so never share any code with a caller. |
Here is your homework, and it is gentle: this week, sign in to your email account, open its security settings, and look for the word Passkeys. Create one, test it by signing out and back in, and enjoy the small thrill of watching the door open with just your fingerprint.
Then take one more minute to learn where that passkey actually lives. On most phones it sits in the built-in password manager, and that manager, not the email site itself, controls how your passkeys come back on a replacement phone.
Check its recovery requirements now, while everything works, because some ask for your old phone's passcode, a manager PIN, or another trusted device. Keep your passwords written down somewhere safe at home while you learn.
You have adapted to touch-tone phones, ATMs, and smartphones. This change is easier than any of those.
Sources
- FIDO Alliance, The State of Passkeys: Global Consumer and Workforce Report (2026)
- FIDO Alliance, Passkey Index (October 2025)
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report (2026)
- AARP, FBI Report: Internet Crime Losses Hit $20.9 Billion (2026)
- Cybernews, Analysis of 19 Billion Passwords Exposed in Data Breaches (2025)