The password was supposed to be dead by now. For a few years the industry spoke about it in the future tense that always precedes a funeral: passkeys were coming, the era of typing a secret string into a box was ending, and soon your face or your fingerprint would be the only key you needed. Then 2026 arrived, the technology genuinely won — and the password stubbornly, annoyingly, refused to die. Understanding why is more useful than any “passwords are obsolete” headline, because the reason passwords survive tells you exactly where your real security risk now lives.
First, the part that actually happened
Let’s be clear that this is not a story about a technology that flopped. Passkeys — cryptographic credentials that live on your device and log you in with the same biometric you use to unlock your phone — have been adopted at a scale that makes most “next big thing” claims look modest. More than 800 million Google accounts now use them, Amazon enabled them for 175 million customers and reports sign-in roughly six times faster than typing a password, and Microsoft made passkeys the default sign-in method for all new accounts in May 2025. The aggregate is staggering: the FIDO Alliance reports 1.3 billion passkey authentications per month, double the figure from a year earlier.
And the security case is not marketing. A passkey cannot be phished, because there is no secret to hand over to a fake login page. It cannot be stolen in a database breach, because the server only ever stores a public key — the private half never leaves your device. This genuinely closes the two attack methods — phishing and credential-database theft — that account for an enormous share of real-world account compromise. On the merits, passkeys are the first real upgrade to logging in since the password itself.
So why is the password still here?
Here is the irony at the center of the whole transition, and it is the thing almost no adoption headline mentions. The password survives because of what happens when things go wrong — and passkeys, for all their elegance, made that part harder, not easier.
Consider what “I lost my phone” means under each system. With a password, recovery is annoying but understood: you click “forgot password,” get a reset link, and you’re back in. With passkeys, there is a genuinely awkward problem underneath. The core FIDO2 standard has no built-in recovery flow — so if you lose every device holding your passkeys, the common fallback is an email reset link, the exact weak point passkeys were meant to render obsolete. Read that twice, because it is the whole story in one sentence. The technology built specifically to kill the phishable email-reset link often ends up… relying on the phishable email-reset link as its safety net.
This is why services keep the password field on the login screen. It is not inertia or laziness. The password is the recovery anchor — the thing that gets you back in when the elegant new system locks you out — and until the recovery story is solved, no responsible service can fully remove it.
The weakness didn’t disappear. It moved.
This is the reframe that makes the whole passkey era make sense: passkeys did not eliminate the password’s weakness so much as relocate it. The old vulnerability was at the front door — a secret you typed, which could be phished, guessed, or stolen. Passkeys bolt that door shut. But security researchers, and the FIDO Alliance itself, have been blunt that a passkey-protected account is only as strong as its recovery path, and plenty of services still fall back to an email link or a support phone call that reintroduces the exact vulnerabilities passkeys were built to remove. A rollout that skips hardening recovery, as those researchers put it, hasn’t fixed the risk — it has just moved it to the back door.
There is a second relocated cost, too: lock-in. A passkey synced through Apple’s iCloud Keychain works beautifully across your Apple devices and turns into a QR-code-and-Bluetooth fumble the moment you try to use it on a Windows PC or an Android phone. The convenience is real but it is ecosystem-shaped, and it quietly raises the cost of ever leaving the ecosystem you started in. This is improving — portability standards and cross-platform import are arriving — but for now, “seamless” often means “seamless as long as you stay where you are.”
What to actually do
The correct takeaway is not “passkeys are overhyped” — they aren’t — and it is definitely not “keep using passwords because the new thing is fiddly.” It is more precise than either: adopt passkeys for their real strengths, but understand that you have changed the shape of your risk, not erased it. Turn on passkeys for your important accounts, because closing the phishing and breach doors is a genuine, large win. But treat recovery as the thing that now matters most — because it is where the weakness went. In practice, that means storing passkeys in a cross-platform manager rather than a single vendor’s keychain, setting up more than one device or a hardware key so a lost phone isn’t a lockout, and hardening the email account that sits behind all your recovery flows, because it has quietly become the master key to everything.
The honest verdict for 2026 is that the password isn’t dead; it has been demoted. It is no longer your front-line credential — it is the emergency fallback, the thing behind the glass marked “break in case of lockout.” That is a real and worthwhile change. But anyone who tells you the password is gone is describing a finish line the industry has not actually crossed — and mistaking the demotion for a death is exactly how people get complacent about the recovery flows that are now the softest part of their security.
Related reading: Chrome Broke Ad Blockers and AI Answers Broke Traffic. It’s the Same Story.
