Passwordless Authentication: A 2026 Guide to Passkeys

dev.to Security2026-11-11 16:000 views

Per the FIDO Alliance, around 5 billion passkeys are now in use and passkey logins succeed about 93% of the time versus about 63% for passwords. Yet 57% of organisations still use a phishable method as their primary sign-in.

Awareness isn't the problem. Implementation is. Here's what shipping passkeys properly actually involves.

How a passkey works (FIDO2 / WebAuthn)

Registration: your server sends a random challenge; the browser calls navigator.credentials.create(); the authenticator generates a key pair and returns the public key plus a credential ID.
Storage: you store the public key and credential ID against the user. The private key never leaves the device.
Sign-in: your server sends a new challenge; the browser calls navigator.credentials.get(); the device signs it after a biometric/PIN check; your server verifies the signature with the stored public key.

No shared secret means no phishing-replayable credential, no credential stuffing and nothing worth stealing from your database.

What "done properly" requires

WebAuthn-compliant client and server code (challenge handling, origin and RP ID validation, signature verification)
A fallback for unsupported devices
A deliberate account-recovery design: backup passkey, identity-verification fallback, user education at signup

Cross-device sync happens via iCloud Keychain, Google Password Manager and others, but cross-ecosystem sign-in may need a QR-code flow, so test across ecosystems.

The FIDO research notes about half of organisations rely on developers with limited authentication experience, and fewer than a third have dedicated IAM engineers. Don't hand-roll the crypto; use a vetted library and review the recovery paths.

Measure the right thing

There's a 12–18 percentage-point gap between passkeys saved and passkeys used in the last 30 days. Track active use over a rolling window, not registrations.