7 Billion Passkeys: Making Passwordless the Enterprise Default

The passwordless transition has crossed a definitive threshold. According to data unveiled at Authenticate 2026 and published in the FIDO Alliance 2026 Passkey Index, more than 7 billion passkeys are now active globally. Large consumer platforms across banking, retail, and telecommunications—including JPMorgan Chase, Amazon, PayPal, and Google—report that over a third of their successful logins now rely on WebAuthn-backed passkeys.

Yet behind this volume lies an architectural challenge facing customer identity and access management (CIAM) and workforce IAM teams. While platform availability has reached broad maturity, actual user opt-in still lags behind technical availability across typical enterprise applications, as noted in recent ecosystem adoption analyses.

The industry conversation has moved past whether cryptographic credentials work at web scale. For identity security architects and platform leads, the mandate is now operational: how to shift passkeys from an optional self-service feature into the default authentication mechanism without disrupting conversion rates or introducing account recovery gaps.

The Gap Between Availability and Primary Use

For the past three years, enterprise CIAM engineering concentrated on platform compatibility. Identity teams deployed WebAuthn APIs, integrated synced credential providers across iOS, Android, and Windows ecosystems, and verified cross-device authentication via hybrid QR flows.

Technically, passkeys are available to nearly the entire consumer base. Functionally, however, many enterprise deployments left passkeys configured as a secondary or voluntary alternative. When presenting users with traditional password fields alongside a passkey enrollment prompt, default user inertia prevails:

• Familiarity bias: End users defaulted to saved passwords and browser autofill unless actively prompted during a sign-in interruption.
• Secondary registration friction: Treating passkeys as an "account settings" toggle rather than an inline registration event resulted in single-digit enrollment rates for non-tech-savvy cohorts.
• Fallback dependency: Platforms that kept legacy knowledge-based credentials active remained exposed to credential stuffing, adversary-in-the-middle (AiTM) phishing proxies, and automated credential stuffing against API endpoints.

Bridging the gap between the 7 billion credentials registered across platform authenticators and actual enterprise risk reduction requires turning passkeys into the primary, zero-click sign-in flow.

Architectural Requirements for "Default-First" CIAM

Deploying passkeys as the default experience requires re-evaluating core customer identity user journeys. Identity architects must address three distinct architectural components: conditional UI autofill, inline registration triggers, and progressive fallback gating.

1. WebAuthn Conditional Mediation

Legacy password forms require explicit user input before evaluating the credential type. A modern CIAM architecture implements WebAuthn Conditional UI (Form Autofill).

When the user interacts with an input field, the browser automatically surfaces existing passkeys alongside stored passwords directly in the system autofill accessory. The authentication request executes silently via navigator.credentials.get({ mediation: 'conditional' }).

By placing the passkey inside the user's muscle-memory path—the autofill bar—organizations eliminate the mental friction of choosing between multiple authentication options.

2. Just-In-Time Registration at Contextual Milestones

Directing users to an account management panel to "create a passkey" generates low adoption. The most successful consumer rollouts integrate passkey creation into high-trust session moments:

• Post-Authentication Prompts: Immediately following a successful legacy MFA or password validation, prompt the user with a single-click native passkey registration request.
• High-Value Transaction Checkouts: When a user completes a payment or account profile verification, trigger passkey enrollment backed by biometric device authorization.
• Session Step-Up Events: Instead of issuing SMS OTPs during risk score increases, use step-up challenges to bind an authenticator to the device.

This approach converts users precisely when their device session is verified and their willingness to establish a faster future login is highest.

[ User Completes Authentication (Legacy MFA / Password) ]
                           │
                           ▼
             [ Adaptive Engine Evaluates Context ]
             ├── High Risk / Untrusted IP ──► Proceed without prompt
             └── Low Risk / Verified Device
                           │
                           ▼
          [ Inline Prompt: "Enable Instant Passkey Login" ]
                           │
             ┌─────────────┴─────────────┐
             ▼                           ▼
      User Approves                User Dismisses
             │                           │
  [ WebAuthn navigator.         [ Session Continues; Set
    credentials.create() ]        Suppression Cooldown ]
             │
             ▼
   [ Public Key Stored in 
     CIAM Provider ]

3. Progressive Deprecation of Shared Secrets

Reaching default-passkey status requires an intentional path toward retiring shared secrets. Organizations cannot simply delete password databases overnight, but they can apply structural friction to legacy mechanisms:

• Passkey-First Interface Routing: Hide password inputs behind a secondary link ("Try another way"), ensuring the browser attempts cryptographic negotiation first.
• Risk-Based MFA Elevation for Password Logins: Treat password-based logins as inherently suspect, requiring phishing-resistant push or FIDO step-up, while passkey sessions authenticate instantly with lower friction.
• Password Elimination for Net-New Accounts: Allow new users to register exclusively via passkey, eliminating credential storage in the customer database entirely for onboarding cohorts.

Identity Lifecycle Risks in High-Scale Deployments

As passkeys reach consumer ubiquity, enterprise security teams must anticipate where adversarial tactics adapt. While passkey signatures eliminate credential replay on the wire, the surrounding identity lifecycle presents distinct operational considerations:

Identity Recovery and Proofing

Because passkeys cannot be phished via reverse proxies, threat actors increasingly focus on identity proofing during account recovery. If an end user loses access to their synced credential ecosystem (e.g., losing access to an Apple or Google account), the enterprise must avoid falling back to vulnerable out-of-band channels like SMS or email OTPs.

CIAM platforms should integrate verifiable credentials, government digital IDs, or cryptographically signed recovery tokens rather than relying on basic knowledge-based questions.

Synced vs. Device-Bound Credentials

CIAM teams must distinguish between synced passkeys (multi-device credentials managed by operating system ecosystems) and enterprise hardware-bound passkeys (FIDO2 tokens with non-exportable private keys).

For consumer identities, synced passkeys provide the resilience and cross-device usability needed to support billions of logins without massive support overhead. For high-privilege corporate administrators, device-bound attestation should remain mandatory via enterprise attestation policies.

Key Recommendations for Security Engineering Teams

1. Audit Sign-In Telemetry: Measure the ratio between passkey-capable user endpoints and active passkey authentications. Identify where drop-off occurs between enrollment availability and usage.
2. Implement Conditional UI Across All Frontends: Upgrade WebAuthn client-side implementations to support conditional mediation on desktop and mobile web experiences.
3. Redesign Enrollment as an Inline Event: Transition enrollment flows away from static settings menus into post-login and checkout intercept moments.
4. Harden Recovery Workflows: Ensure that account recovery does not default to insecure legacy mechanisms that undermine the phishing resistance gained at primary login.
5. Establish Phased Password Sunsetting: Introduce policy constraints that progressively route users toward passkey defaults while containing legacy authentication vectors.

The milestone of 7 billion deployed credentials demonstrates that the cryptographic groundwork for passwordless access is complete. The challenge for enterprise architects now centers on orchestration: structuring CIAM flows to make passkeys not just an available option, but the default standard for everyday authentication.