The password’s long obituary has been written many times, but the numbers are finally catching up with the rhetoric. Passkeys, the phishing-resistant sign-in method built on public-key cryptography and unlocked with a face, fingerprint or PIN, now account for a very large share of consumer logins on the biggest platforms, by some industry accounts passing the halfway mark for consumer sign-ins. For most users the change arrived quietly: the prompt simply started offering a faster way in.
That quietness is the achievement. Earlier attempts to kill the password asked users to learn something new, carry something extra or trust something unfamiliar. Passkeys hide inside devices people already own and habits they already have. Unlock the phone, and you are signed in. The security upgrade rides on convenience, a lesson the industry took decades to learn and one that shapes much of the coverage on our homepage.
Why Passkeys Resist Phishing
A password is a shared secret, and anything shared can be stolen, guessed, reused or typed into the wrong website. A passkey is different in kind. Your device holds a private key that never leaves it, the service holds a matching public key, and the two prove their identities to each other cryptographically. Crucially, a passkey is bound to the real site it was created for, so a convincing fake banking page cannot trick your device into signing in to it. There is nothing useful to phish.
The model also shrinks the damage from breaches. A leaked database of public keys gives attackers little to work with, and there is no password to reuse across services, the habit behind most account-takeover cascades. Industry groups and platform makers describe adoption and security outcomes on their own channels, while independent reporting by BBC News has charted the method’s move from standards documents into everyday banking, shopping and email accounts.
Friction, Recovery and the Remaining Gaps
Passkeys are not frictionless everywhere. Moving between ecosystems, sharing accounts within families, and recovering access after losing every device remain the rough edges. Services have answered with cross-device sign-in using QR codes, synced passkeys held by platform accounts, and fallback methods that, if left weak, can undermine the whole design. Security teams reading the guides in our tech section will know the recurring warning: an account is only as strong as its recovery path.
Enterprises have moved more slowly than consumers, weighing device management, helpdesk processes and staff who work across shared terminals. Even there, direction is clear. Hardware-backed credentials for administrators came first; broader workforce rollouts are following as identity platforms smooth enrolment. Regulators and cyber insurers, both tired of credential-driven breaches, have begun nudging laggards along.
The Password’s Long Tail
Half of logins is not the end of the password. Older services, niche devices and edge cases will keep passwords alive for years, and attackers will concentrate on exactly those leftovers. Users will still need password managers for the tail, and services will still need to defend reset flows that criminals probe relentlessly. Consumer safety advice from groups including the Guardian‘s technology desk is consistent on the essentials: turn on the strongest sign-in offered, and treat unexpected prompts with suspicion.
What has changed is the default. For a generation, the burden of authentication sat with human memory. Passkeys move it to devices and mathematics, where it belongs. Passing half of consumer logins is a milestone less for the technology, which worked from the start, than for the collective decision to finally ship it. For ordinary users, the practical takeaway remains simple and reassuring: accept the passkey prompt when your bank, email provider or favourite shop offers it, keep your devices updated, and let the mathematics carry a burden that memory never should have carried alone.
