What Changed
Amazon's passkey deployment has reached a significant milestone: 465 million customers now authenticate without passwords. This isn't a pilot program or an obscure option. It's the default sign-up method.
The FIDO Alliance reports five billion passkeys in active use across the industry, marking a fundamental shift in large-scale authentication. Amazon's data provides specific metrics: passkeys authenticate six times faster than traditional passwords, and adoption grew 75% year-over-year from the start of 2026.
This isn't just about Amazon. Multiple e-commerce marketplaces have adopted passkeys in a coordinated rollout, supported by the FIDO Alliance. This pattern indicates we've moved from experimentation to full-scale deployment.
Key Findings
Passkeys solve the security-usability trade-off
Stephen Schmidt, Amazon's Chief Security Officer, states, "Stronger security usually means a worse experience for the customer. Better usability usually means weaker protections. Passkeys break that pattern." The six-times-faster authentication isn't just a slight improvement. It's the difference between users reusing passwords and enjoying a seamless experience.
Customers chose experience, got security as a side effect
Amazon's data shows customers adopted passkeys for speed and convenience, not because they understood phishing-resistant authentication. The security improvement was an added benefit, reversing the usual challenge where security teams push controls that users resist.
Default matters more than availability
Amazon made passkeys the default sign-up method, not an option buried in settings. This decision drove large-scale adoption. If you hide passkeys in account preferences, you'll see minimal adoption regardless of the technology's quality.
Industry coordination accelerated deployment
The FIDO Alliance's role wasn't just about publishing standards. Members worked directly with Amazon and other marketplaces to build, deploy, and troubleshoot passkeys in production. This coordination prevented the fragmentation that hindered previous authentication improvements.
The growth curve is steep
A 75% year-over-year growth from early 2026 shows passkey adoption isn't plateauing. It's accelerating. For IAM architects planning 2027 roadmaps, this trajectory suggests passkeys will become essential faster than previous authentication shifts.
What This Means for Your Team
If you're managing authentication for a customer-facing application, you're now competing against a six-times-faster baseline. Users who authenticate with passkeys on Amazon will notice the delay when your login still requires a password and a Time-Based One-Time Password.
For enterprise IAM, the implications are deeper. Passkeys eliminate entire risk categories: credential stuffing attacks fail without passwords to exploit. Phishing-resistant authentication means your help desk stops resetting compromised credentials. Password rotation policies become irrelevant.
But you can't just flip a switch. Your identity provider needs FIDO2 support. Your applications need WebAuthn integration. Your user onboarding flow must guide users through passkey setup without feeling like a security lecture. You also need a migration path for users who can't or won't adopt passkeys immediately.
Coordination is crucial. If your organization runs multiple customer-facing applications, inconsistent passkey support creates confusion. Users won't understand why they can use a passkey on one platform but not another.
Action Items by Priority
1. Audit your authentication stack for FIDO2 readiness
Check if your identity provider supports WebAuthn and passkey storage. If you're using an on-premises identity system, verify it can handle public key cryptography for authentication. Don't assume your current Multi-Factor Cryptographic Device support translates to passkey support. The protocols differ.
2. Map your user journey for passkey enrollment
Identify where in your onboarding flow you'll introduce passkeys. Amazon defaulted to passkeys at sign-up, but you might need a different approach if you're migrating existing users. Test the enrollment experience on multiple devices. A passkey flow that works on iOS Safari might fail on Android Chrome.
3. Build fallback paths that don't undermine security
Users will lose devices. They'll switch phones without migrating passkeys. Your fallback authentication can't be "just use your password" if you're trying to eliminate passwords. Consider account recovery flows that use email verification or support contact, but design them to resist social engineering.
4. Coordinate across your application portfolio
If you manage multiple customer touchpoints, synchronize your passkey rollout. Inconsistent authentication creates support burden and user confusion. You don't need simultaneous deployment, but you need a clear timeline and consistent messaging.
5. Instrument your authentication metrics
Track passkey adoption rates, authentication success rates, and time-to-authenticate. Amazon's six-times-faster metric gives you a benchmark. If your passkey flow isn't faster than your password flow, you've introduced friction instead of removing it. Measure the difference between passkey authentication attempts and successful completions to identify where users struggle.
6. Plan your password deprecation timeline
Don't try to eliminate passwords overnight, but don't leave them as an equally-promoted option either. Set adoption targets (e.g., 50% of active users on passkeys within six months), then gradually de-emphasize password authentication. Remove password fields from your primary sign-in screen once passkey adoption crosses a threshold that works for your user base.
