An estimated 5 billion passkeys are now in active use worldwide, and 90 percent of people say they know what a passkey is, according to the FIDO Alliance’s most recent global tracking (FIDO Alliance, 2026). On the business side, 68 percent of organizations have deployed or are actively deploying passkeys for employee sign-in, and 82 percent say a fully passwordless workforce is their eventual goal.
The technology isn’t experimental anymore. Most people already use it, often without thinking about it, every time they unlock a banking app with a fingerprint or sign in to a personal account with their face. The businesses still relying entirely on passwords for employee access are increasingly the exception.
How a Passkey Actually Works
A password is a shared secret. You know it, the website knows it, and anyone who tricks you into typing it somewhere else knows it too. A passkey works differently. When you create one, your device generates a matched pair of cryptographic keys. The public key goes to the service. The private key stays on your device, protected by your fingerprint, face or device PIN. When you sign in, the service sends a challenge that only your private key can answer, and your device answers it after you confirm with a biometric or PIN.
The important part is that the private key never leaves your device and is tied to the specific website or app it was created for. There’s nothing to type, so there’s nothing to type into a fake login page. A phishing site on a look-alike domain simply won’t receive a valid response.
Why This Matters More Than It Sounds
Passwords fail in well-understood ways. They get phished, reused across sites, guessed, or bought in bulk on criminal marketplaces after an unrelated breach. The FIDO research found 33 percent of people had an account compromised or received a breach notification in the past year, which shows how routine password exposure has become.
Multi-factor authentication helped enormously, but attackers have adapted. One-time codes can be phished in real time through fake login pages that pass the code straight to the real site. Push notifications can be defeated by “MFA fatigue,” where an attacker triggers prompt after prompt until a tired employee taps approve. Neither technique exploits a technical flaw. They exploit the fact that a person can be talked into handing something over. Passkeys remove that possibility because there’s nothing to hand over.
The Business Case Goes Beyond Security
Organizations that have rolled out passkeys report practical gains alongside the security benefit: 45 percent report faster employee logins, 43 percent report higher satisfaction with IT, and 35 percent report fewer password-reset help desk tickets. That last number often makes the business case by itself. Password resets are one of the most common help desk requests, and every one of them is time an employee isn’t working.
Passkeys also support a stronger position with cyber insurers, who increasingly ask about phishing-resistant authentication on renewal applications, and with compliance frameworks that call for strong identity controls.
Why Most Small Businesses Haven’t Moved Yet
It’s rarely resistance to the idea. Passwordless rollout touches email, remote access, line-of-business applications and every other system a team signs in to each day. Some older applications don’t support passkeys yet. Employees have questions about what happens if they lose their phone. Doing it piecemeal, one app at a time with no plan, creates more confusion than it solves.
The businesses that get real value from passkeys roll them out deliberately, starting with the highest-risk systems and expanding from there.
A Practical Rollout Path
- Start with email and identity. Microsoft 365 and Google Workspace both support passkeys. Since email is the gateway to password resets for everything else, protecting it first gives the biggest return.
- Cover remote access next. VPNs and remote desktop tools are frequent targets and should require phishing-resistant sign-in.
- Plan for lost devices. Register more than one passkey per person, such as a phone and a laptop, or issue a hardware security key as a backup, and write down the recovery process.
- Inventory the rest. List every business application and note which support passkeys or single sign-on. Apps that don’t can sit behind SSO so employees still use one strong sign-in.
- Train briefly and clearly. A five-minute explanation of what a passkey is and why it’s safer prevents most of the confusion.
- Retire passwords where you can. Once passkeys are working, remove password sign-in as an option on supported systems so attackers can’t fall back to it.
Where Passwords Still Linger
Going fully passwordless is a journey, not a switch. Some vendor portals, older software and shared accounts will need passwords for a while. For those, a business password manager is the right interim step. It replaces spreadsheets and sticky notes with unique, strong passwords that staff never have to remember, and it gives you a single place to revoke access when someone leaves.
Passkey Questions
What is a passkey?
A passkey is a sign-in credential built on a pair of cryptographic keys. The private key stays on your device and unlocks with a fingerprint, face or PIN, so there’s no password to type or steal.
Are passkeys safer than MFA codes?
Yes. One-time codes and push approvals can be phished or approved by mistake. Passkeys are tied to the real website, so a fake login page can’t use them.
What happens if an employee loses their phone?
Register more than one passkey per person, such as on a phone and a laptop, or issue a hardware security key as a backup, and document the recovery process ahead of time.
The Takeaway
Passwords aren’t going away overnight, but they no longer need to be the thing standing between an attacker and your business. Passkeys are proven, widely supported and easier for employees than what they use today. The smartest move for most small businesses is to start with email and remote access this quarter, put a password manager in place for everything else, and expand from there. If your team still shares passwords in a spreadsheet or a group chat, that’s the clearest sign it’s time to start.
Cloud9 Tech Solutions helps clients plan a passwordless rollout that fits their actual systems, as part of the identity and access management work inside our security stack, aligned with the Zero Trust approach we build into every client’s environment.
If your team is still managing passwords in a spreadsheet or a shared document, that’s a bigger risk than it feels like day to day. Schedule a free security assessment with Cloud9.