FIDO’s new passkey index looks beyond enrolment

Having a passkey is one step

FIDO Alliance released its 2026 Passkey Index on 15 October, bringing together data from 15 consumer services. The report’s useful distinction is between creating a passkey and returning to use it. Its results were compiled on 21 September, so the publication date marks the release of the report rather than a new day of measurement. [1] [2]

For the 12 participants reporting this measure, passkeys accounted for an average of 36% of successful sign-ins. The report uses unweighted averages: each reporting service contributes equally, regardless of its size. This measure includes re-authentication and excludes account recovery. It describes those participating services, rather than a measured share of every sign-in on the internet. [2]

Registration and use are different journeys

The distinction also appears in the underlying web standard. W3C’s Web Authentication Level 3 Recommendation, published on 25 August, separates registration, which creates a credential associated with an account, from authentication, which uses that credential. That standard supplies technical context for the two journeys; it does not confirm the Index’s usage figures. [3]

Alongside the release, FIDO estimates that seven billion passkeys are in use worldwide. That is the Alliance’s estimate of credentials, not a count of seven billion individual people. We have not independently verified it. Keeping the unit visible helps prevent a large headline number from answering a different question from the one a reader has in mind. [1]

Keep the comparison in proportion

The report itself places a boundary around comparisons with last year. Its group has grown from nine services in 2025 to 15 in 2026. FIDO describes year-to-year comparisons as directional because the groups differ. Those comparisons therefore cannot be read as a before-and-after measurement of an unchanged set of services. [2]

Our interest is the ordinary moment when someone returns to a website. Can they recognise the available sign-in route and understand the next step? A registration count gives a team one piece of information. The experience of returning users asks a separate design question, including whether familiar words and a clear sequence help people understand what they are being offered.

Make the next step understandable

For South African teams designing a consumer service, our suggested exercise would be a paper walkthrough of a fictional sign-in screen. Ask someone to explain what they think each option means and what they expect to happen next. Use no real account or credentials. This is a design exercise we propose, not a test we have run or a recommendation to change an account’s authentication settings.

The Index’s most useful contribution is that it makes routine use part of the conversation about passkeys. Our view is that progress should remain understandable at the scale of one visit as well as visible in aggregate figures. A well-explained next step is something a reader can recognise, even without knowing the terminology behind it.

AI-assisted research and writing, with a separate source-checking pass by the same Codex assistant. The FIDO announcement and report share a publisher; W3C provides historical standards context, not independent validation of the data. We have not replicated the Index or performed the proposed paper walkthrough. No South African adoption rate or security, speed or savings guarantee is asserted.