Passkeys went from a technical curiosity to a boardroom conversation in under 18 months. At Auth0 World 2022, survey data from conference attendees revealed that 34% of enterprises had deployed or were actively piloting passkeys for at least one use case - up from just 11% the prior year. That is a threefold increase in adoption for a technology that requires changes to authentication infrastructure, user experience flows, and recovery procedures.
The numbers are impressive. They are also misleading if taken at face value, because “deployed passkeys” covers a wide range of maturity levels. Some organizations have full FIDO2 passwordless authentication for customer-facing applications. Others have a small pilot for IT staff accessing internal tools. The gap between those two states is enormous.
What Is Driving Adoption
Three forces converged to push passkeys from specification to deployment.
Platform vendor commitment made passkeys accessible. Apple’s integration of passkeys into iCloud Keychain with iOS 16 and macOS Ventura, Google’s passkey support in Android and Chrome, and Microsoft’s Windows Hello integration collectively eliminated the biggest historical barrier to FIDO2 adoption: the need for dedicated hardware security keys. Users can now create and use passkeys with the biometric sensors already built into their devices. This removed the logistics problem of distributing physical tokens at scale.
Phishing resistance became a board-level priority. High-profile breaches driven by phishing and social engineering - Twilio, Uber, Cisco, and others in 2022 alone - demonstrated that SMS-based MFA and TOTP codes are not sufficient against motivated attackers. Passkeys provide cryptographic phishing resistance by binding the credential to the origin. There is no code to intercept, no link to redirect, and no credential to replay.
Regulatory pressure tightened expectations. CISA’s push for phishing-resistant MFA, updated NIST guidance favoring FIDO2, and the EU’s evolving digital identity framework all signaled that stronger authentication is becoming a compliance requirement rather than a best practice recommendation.
The Account Recovery Problem
Every identity architect who has evaluated passkeys runs into the same wall: what happens when a user loses their device?
With passwords, recovery is straightforward if imperfect. The user clicks “forgot password,” receives an email, and sets a new credential. The process has known weaknesses, but it works and users understand it.
With passkeys, recovery is fundamentally harder. If the passkey is bound to a device and that device is lost or destroyed, the user cannot authenticate. The cryptographic key material is gone. There is nothing to reset from the server side because the server never had the private key.
Platform sync mechanisms - iCloud Keychain, Google Password Manager - partially address this by replicating passkeys across a user’s devices. If you lose your phone but still have your laptop, your passkeys are still available. But this creates a new dependency: the security of your passkeys now depends on the security of your platform account. A compromised iCloud or Google account could expose all synced passkeys.
For enterprises, the recovery problem is more acute. An employee who is locked out of their passkey cannot work. The IT help desk needs a recovery procedure that is both secure and operationally feasible. Most organizations implementing passkeys today maintain a fallback authentication method - typically a hardware security key registered separately, or a traditional password with MFA as a backup path.
This creates an awkward reality: passkeys are phishing-resistant, but the fallback mechanisms often are not. The overall security posture is only as strong as the weakest recovery path.
Workforce vs. Customer Deployment
The passkey adoption story differs significantly between workforce and customer identity use cases.
Customer-facing passkey deployment is moving faster because the economics are compelling. Every passwordless authentication reduces help desk calls for password resets, decreases cart abandonment from forgotten credentials, and improves the user experience. The risk tolerance is also higher - a locked-out customer is a revenue problem, not an operational crisis. Organizations like PayPal, eBay, and various financial institutions rolled out customer passkeys early because the ROI was clear.
Workforce passkey deployment is more conservative. The stakes are different when a locked-out user cannot access production systems or respond to a security incident. IT teams need confidence in the recovery process before they can mandate passkeys. Most workforce deployments in 2022 were opt-in pilots, often targeting security-conscious teams like engineering or IT operations who are more tolerant of new authentication workflows.
The tooling gap also matters. Customer identity platforms (Auth0, Okta Customer Identity, Ping) added passkey support quickly because it differentiates their product. Workforce identity platforms have been slower, partly because the enterprise deployment model requires more complex policy controls - conditional access, device trust, step-up authentication - that need to integrate with passkey flows.
Passkeys Complement Passwords - For Now
The most pragmatic takeaway from the Auth0 World discussions was that passkeys are additive, not replacement, in most current deployments.
Organizations are offering passkeys as an option alongside passwords. Users who enroll a passkey get a better, faster, more secure authentication experience. Users who do not enroll continue using passwords with traditional MFA. Over time, as passkey enrollment rates increase and recovery procedures mature, organizations plan to increase the pressure - making passkeys the default, then eventually the requirement.
This phased approach acknowledges a practical reality: you cannot force hundreds of millions of consumer users or tens of thousands of employees onto a new authentication method overnight. The migration path matters as much as the destination.
What Remains Unsolved
Beyond account recovery, several open questions remain for enterprise passkey deployment.
Attestation and device trust - how does the relying party verify that a passkey was created on a device that meets security requirements? FIDO2 attestation provides some answers, but enterprise policy engines need more granular controls.
Cross-platform portability - a passkey created in Apple’s ecosystem cannot easily move to a Google or Microsoft ecosystem. Users with mixed-platform environments face friction. The FIDO Alliance’s work on credential exchange protocols aims to address this, but the specifications are still in development.
Shared device scenarios - kiosk environments, shared workstations, and manufacturing floor terminals do not fit the personal-device model that passkeys assume. These use cases still need alternative solutions.
Audit and compliance - enterprise security teams need visibility into passkey enrollment status, usage patterns, and key lifecycle events. The tooling for passkey-specific audit trails is still immature.
The trajectory is clear: passkeys will become the dominant authentication method for both consumer and enterprise use cases. But the transition period - where passkeys coexist with passwords, recovery procedures are imperfect, and tooling is still catching up - will last several more years. Organizations that start their passkey journey now are building institutional knowledge that will pay off as the ecosystem matures.