Seven billion passkeys are now in use worldwide, according to FIDO Alliance estimates. Roughly 90% of accounts are eligible for a passkey, yet only 42% are enrolled. Enrollment is a one-time event. Usage is a daily habit, and this is where passwordless programs stall.
The Core Challenge
Once a user has a passkey, should you push them off the password, or pull them toward the passkey?
This is the key design decision behind the adoption gap. FIDO notes that more than a third of successful sign-ins now use a passkey, and people with passkeys are using them more often. However, passwords remain deeply embedded. Closing the gap between enrollment and regular use is the central challenge.
Two approaches have emerged: one advocates for enforcing the transition with policy, while the other suggests earning it through user experience.
The Case for Pushing: Remove the Fallback
The enforcement camp starts with a simple observation. A passkey is Phishing-Resistant Authentication only if it's the sole path in. If an attacker can still reach a password prompt, a One-Time Password challenge, or an SMS recovery flow on the same account, your attack surface hasn't shrunk. You've added a door and left the old ones unlocked.
Practitioners in this camp argue:
- Downgrade attacks are the real threat. Adversary-in-the-middle kits don't break FIDO2. They steer users to the weakest remaining method. If passwords remain available, the passkey is merely decorative.
- Optional means unused. Users take the path of least resistance. If the password field is available and muscle memory says type, they'll type.
- Dual stacks cost more. Every retained credential type needs reset flows, password hashing storage, breach monitoring, and help desk training. Retiring passwords is how you reclaim that cost.
For privileged users, this case is strong. Administrators, finance approvers, and anyone with access to sensitive systems should be moved to passkey-only or Multi-Factor Cryptographic Device authentication without password fallback.
The Case for Pulling: Earn the Habit
The experience camp argues that forced migration fails with users you can't afford to lose: occasional users, contractors, and customers.
Their arguments are:
- Recovery is the weak point. If a user loses a device and your recovery flow is a help desk call or an email link, you've traded a phishable password for a socially engineerable reset. Removing passwords before fixing recovery moves risk rather than eliminating it.
- Cross-device friction is real. Users with a shared workstation, an older browser, or a mix of platforms hit dead ends. A dead end at login becomes a ticket, then an exception, then a permanent password carve-out.
- Trust matters. Users who feel locked out blame the new method. A passkey prompt that appears at the right moment, with clear wording and a visible benefit, builds the habit that mandates can't.
This camp also points to UX as the lever FIDO itself emphasizes. The new FIDO Passkey Rubric is described as a practical checklist combining FIDO's research, UX guidance, and expert knowledge. This suggests the Alliance sees interface and flow design, not cryptography, as the remaining bottleneck.
Where Practitioners Actually Land
Most mature teams don't pick a side. They segment.
- By risk tier. Privileged and high-value accounts get enforcement. Everyone else gets nudges. This aligns with how you run Certification Campaigns and Just-in-Time Elevation: the stronger the access, the stricter the control.
- By lifecycle stage. New accounts are the easiest to convert. Offer passkey enrollment at first sign-in and never create a password. Existing accounts need a gentler path: prompt for enrollment after a successful password login, when the user is already authenticated and motivated to skip the next typing session.
- By measured behavior. Enrollment rate alone is a vanity metric. Track passkey share of successful sign-ins, password fallback rate among enrolled users, and recovery-flow volume. FIDO's Passkey Index gives you an external benchmark for where your numbers sit against the broader market.
- By fallback strength. Teams making real progress treat recovery as part of the authentication system, not an afterthought. They pair passkeys with synced credential recovery, a second registered authenticator, or identity proofing for high-risk resets.
Our Take
The push camp is right about the destination. The pull camp is right about the sequence.
A passkey program that never removes the password isn't complete. The security value of FIDO2 comes from eliminating phishable factors, and a standing fallback undoes that. But removing passwords before building a trustworthy recovery path and a smooth cross-device experience just relocates your weakest link.
So build in this order. First, fix recovery and multi-device enrollment, so a lost phone isn't a lockout. Second, make the passkey the default and most prominent option, and stop prompting for passwords where you can. Third, instrument fallback rates and use them to decide, population by population, when to switch the password off. Fourth, enforce hard for privileged accounts, early.
The 42% enrollment figure tells you people will say yes when asked. The usage gap tells you asking isn't enough. Your job as an architect is to make the passkey the path of least resistance, then close the door behind it.
