Passkeys went mainstream in 2026
The numbers tell the story better than any prediction I could make. By World Passkey Day in May 2026, the FIDO Alliance — the industry body behind the standard — estimated there were around five billion passkeys in use worldwide. In a survey of consumers across ten countries, roughly 90% of people had heard of passkeys, three-quarters had enabled one on at least one account, and about half were using them regularly whenever they were offered. On the business side, more than two-thirds of organisations reported they had deployed passkeys or were actively rolling them out for staff logins.
That is what "mainstream" looks like. When Apple, Google, and Microsoft all build a technology directly into their phones, browsers, and operating systems — and when Microsoft starts making new consumer accounts passwordless by default — it stops being optional knowledge for anyone who runs a business online. Your customers are already using passkeys on their banking and email. The question is no longer whether passkeys are real. It is whether your business is behind the curve on them.
What a passkey actually is
Here is the plain-English version, because the technical explanation scares people off unnecessarily. A passkey is a login credential that lives on your device — your phone, laptop, or a security key — and that you unlock with the thing you already use to unlock the device: your fingerprint, your face, or your device PIN. There is no password to type, remember, or reuse.
Under the hood, a passkey is a pair of cryptographic keys. When you create a passkey for a website, your device generates two mathematically linked keys. One, the public key, is handed to the website and stored on its servers. The other, the private key, never leaves your device — the website never sees it, and neither does anyone else. When you log in, the website sends a challenge, your device signs it with the private key after you approve with your fingerprint or face, and the website verifies the signature using the public key it holds. You are proven to be you without any secret ever crossing the internet.
That last point is the whole game. With a password, the secret — the password itself — has to travel from you to the website every time, which means it can be intercepted, phished, or stolen from the website's database in a breach. With a passkey, the secret never travels and the website never stores anything a thief could reuse. A stolen list of public keys is worthless, because you cannot log in with a public key alone.
Why a passkey beats a password and a texted code
I have written before about two-factor authentication, and I stand by every word of it — turning on 2FA is one of the highest-value security steps a small business can take. But it is worth being clear about how passkeys relate to it, because passkeys are not just a third option. They are, in a sense, both factors rolled into one stronger thing.
Think about what a password plus a texted code protects against. The password is something you know; the code is something you have. The trouble is that both can be phished. A convincing fake login page can capture your password and ask you to type the code your bank just texted you, and if you fall for it in the moment, the attacker has both. Text-message codes have other weaknesses too, including SIM-swapping attacks where a criminal takes over your phone number. A texted code is far better than nothing, but it is not the strong end of the spectrum.
A passkey defeats phishing by design, and this is the part that genuinely changes the security picture. A passkey is cryptographically bound to the exact website it was created for. If you land on a look-alike phishing site, your device simply will not offer the passkey, because the domain does not match. There is no code to read out, no secret to be tricked into surrendering, nothing for the fake site to capture. The single most common way small business sites get compromised — someone gets tricked into handing over their login — stops working. That is why security professionals describe passkeys as phishing-resistant, and why they represent a real step up rather than a lateral move.
Start with your own logins
For a small business, the most valuable place to adopt passkeys is not some grand customer-facing project. It is your own critical accounts — the handful of logins that, if compromised, would ruin your month. Your website admin. Your hosting control panel. Your business email. Your domain registrar. Your online banking. Your Google or Microsoft business account. These are the keys to your kingdom, and they are exactly the accounts that already support passkeys today.
The good news is that adding a passkey is usually a two-minute job. In the security settings of most major services you will now find an option to "add a passkey" or "set up passwordless sign-in." You approve with your fingerprint or face, and the passkey is created and, on most platforms, synced securely through your Apple, Google, or Microsoft account so it works across your devices. You do not have to memorise anything. The next time you log in, you authenticate with your face or fingerprint instead of typing a password.
My practical advice: make a short list of the five or six accounts that would hurt most if someone else got into them, and add passkeys to each one this week. Where the service lets you, keep a strong password and 2FA in place as backup while you transition, rather than deleting your old login method the same day. That combination — passkey for everyday login, a strong backup method held in reserve — gives you the security benefit without the risk of locking yourself out.
Passkeys and WordPress
Since so many Canadian small business sites run on WordPress, it is worth saying where passkeys fit there. WordPress does not yet build passkeys into its core login screen the way the big platforms do, but reputable plugins add passkey support to the WordPress admin login, letting you and your team sign in to wp-admin with a fingerprint or face instead of a password. Several of the well-established security plugins have moved in this direction as the standard has matured.
If you run a WordPress site, protecting the admin login is where an attacker is most likely to strike, and a passkey on that login closes the door on the brute-force and phishing attacks that account for most WordPress break-ins. As always, choose a well-maintained plugin from a developer with a track record, keep it updated, and test the login flow — including your recovery path — before you rely on it. This is exactly the kind of hardening I set up as part of managed hosting, so a client never has to become a security expert to be secure.
There is a second, more ambitious question: should you offer passkeys to your customers — the people logging into your online store or membership site? If you run a site where customers hold accounts, the answer is increasingly yes, because passkeys reduce the two things that quietly cost e-commerce businesses money: forgotten passwords and account takeovers. Fewer password resets means fewer abandoned checkouts and fewer support requests; phishing-resistant logins mean fewer fraudulent account takeovers to clean up. The practical catch is that adding customer passkeys depends on your platform. Some hosted store and membership platforms now support it as a setting you simply switch on, while a custom build needs a developer to implement it properly. My advice for most small businesses is to secure your own critical logins first, where the payoff is immediate and the effort is trivial, and treat customer-facing passkeys as a worthwhile upgrade to plan for once your platform makes it straightforward.
The honest caveats
I am an enthusiast for passkeys, but I am not going to pretend the transition is seamless, because it is not, and you should go in with clear eyes.
The biggest real-world wrinkle is recovery and device loss. If your passkeys are synced through your Apple, Google, or Microsoft account, losing a phone is not a catastrophe — you sign in on a new device and your passkeys come with you. But that makes the security of that underlying account absolutely critical, because it now unlocks everything. If you use device-bound passkeys that do not sync, losing the device means losing that passkey, so you need a second passkey or a backup method registered in advance. Either way, the lesson is the same: set up recovery before you need it, not during a panic.
Shared logins are another awkward spot. Passkeys are tied to individuals and their biometrics, which is a security feature, but it complicates the common small-business habit of several people sharing one admin account. The right answer was always to give each person their own account anyway, and passkeys nudge you toward that better practice. And there is still some unevenness across older devices, browsers, and services — coverage is very good in 2026 but not yet universal, so passwords will hang around as a fallback for a while longer.
None of these are reasons to avoid passkeys. They are reasons to adopt them deliberately: sync where you can, register a backup, give people their own accounts, and keep a fallback until the coverage gaps close.
What to do now
You do not need a project plan for this. Start with the accounts that matter most and add a passkey to each, keeping a strong backup method in place as you go. If you run a WordPress site, add passkey support to your admin login through a reputable plugin and test your recovery path. Give every team member their own account rather than sharing one. And make sure the Apple, Google, or Microsoft account that syncs your passkeys is itself locked down tightly, because it has become the master key.
The password is not going to vanish overnight, and I am not telling you to throw yours away today. But the direction is unmistakable, the tools are mature, and the security gain is the largest single upgrade available to most small businesses. After years of watching passwords fail the people who trusted them, it is a real relief to be able to point to something better that is finally here and finally easy. Adopt it on your own critical logins first, and you will have taken one of the most meaningful security steps available to you in 2026.