Why passkeys?
Passwords have been broken since the day they were invented — they leak, they get reused, they get phished. Passkeys replace them with hardware-backed public-key cryptography that can't be phished, can't be leaked from a database breach, and takes one tap to use.
2026 is the year of the passkey
Passkey support shipped years ago — Apple, Google, and Microsoft all added it in 2022–2023 — but 2026 is the year it actually takes over. Every major browser supports the WebAuthn autofill UI. iCloud Keychain, Google Password Manager, 1Password, Dashlane, Bitwarden, and Windows Hello all sync passkeys across a user's devices. The chicken-and-egg problem is solved: every consumer device a user owns already has a passkey provider built in.
The major identity providers (Microsoft, Google, GitHub, Shopify, Amazon, PayPal, eBay, TikTok, X, Best Buy) have rolled out passkey login. Adoption is now a question ofwhen, not if. PasskeyBase is the fastest way to ship this for your own app.
The business case (the part for the CEO deck)
The security argument for passkeys is well-rehearsed. The argument that's actually moving procurement decisions in 2026 is the revenue and cost argument: passkeys convert better, support cheaper, and lock fewer users out than the password-and-OTP combination they replace. Public numbers from brands that have already shipped:
Conversion uplift at the auth step
- Best Buy — reported a meaningful lift in checkout-flow conversion after enrolling passkeys, attributed to a faster sign-in moment with fewer drop-offs (FIDO Alliance case study, 2024).
- eBay — passkey users complete sign-in 4× faster than password+SMS users; corresponding reduction in mid-funnel abandonment at the auth step.
- Amazon — public statement that passkey sign-in is "6× faster" than password+OTP. At Amazon's scale, single-digit-percent lifts in the sign-in funnel are nine-figure revenue events.
- Shopify — case study reported 4× faster sign-in, ~50% reduction in auth-related support contact volume.
Support-cost reduction
- Forrester puts the loaded cost of a single password reset at $50–$70 for large enterprises (help-desk time + lost productivity). Password resets are the single largest category of help-desk volume in most orgs.
- Gartner estimates 20–50% of all help-desk tickets are password-related. Migrating active users to passkeys eliminates the underlying cause.
- Microsoft reports that since standardizing on FIDO2 internally, password-reset volume from employees has fallen by an order of magnitude.
Fraud and account-takeover loss
- Verizon DBIR (2024) — 80%+ of breaches involve weak, default, or stolen credentials. Phishing remains the #1 initial-access vector. Passkeys eliminate both.
- Microsoft — accounts protected by FIDO2 / passkey have a 99.9% lower compromise rate than password-only accounts.
- IBM Cost of a Data Breach (2024) — average global breach cost $4.45M; credential-driven breaches are the most expensive subcategory.
- PayPal, eBay — both reported notable ATO-rate reductions after passkey rollout (cited in their FIDO Alliance case studies).
Compliance unlock
- PCI-DSS v4.0 requires phishing-resistant MFA for all access to cardholder data environments by March 2025. Passwords + SMS / TOTP doesn't qualify. Passwords + passkey, or passkey-only, does.
- FedRAMP / CMMC / Executive Order 14028 — phishing-resistant authentication is a stated requirement. Shipping passkeys unlocks federal/regulated buyers that you literally cannot sell to without it.
- PSD2 SCA (EU) — passkeys cleanly satisfy "something you have" + "something you are" without the SMS-fallback compliance gymnastics.
The CEO-deck one-liner
Passkeys ship faster sign-in, higher conversion, fewer support tickets, and lower fraud loss in one rollout — and they unlock regulated markets that flat-out require them. PasskeyBase makes the rollout a five-minute integration instead of a six-month project.
What's broken about passwords
- They leak. The Have I Been Pwned database tracks 12+ billion breached credential records. Any password you've ever used has a non-trivial chance of already being public.
- They're reused. ~65% of users reuse the same password across sites (Google/Harris poll). One breach cascades into account takeovers everywhere.
- They're phishable. A convincing fake login page is all an attacker needs. Users hand over the password directly.
- They're expensive. Forrester estimates large enterprises spend $50–70 per password reset in support costs. Most help-desk volume is password resets.
What's broken about SMS / email OTP
- SIM swap. Attackers convince a carrier to port the victim's number; the OTP arrives on the attacker's phone.
- Phishable. The same fake login page that captures a password also captures the OTP and replays it within the 30-second window.
- Slow + expensive. SMS delivery is unreliable globally and costs cents per message at scale.
- Insufficient for compliance. NIST 800-63B has formally deprecated SMS as an out-of-band authenticator since 2017.
What's broken about TOTP (authenticator apps)
- Still phishable. The 6-digit code is a shared secret between the site and the user; anything the user can type, an attacker can capture.
- Lossy migration. Users lose access when they change phones and didn't back up the seed. Recovery is painful.
- UX friction. Switch app, find the right entry, type 6 digits in under 30 seconds. Repeat 5–10 times a day.
What passkeys do differently
Phishing-resistant by design
A passkey is a public/private key pair. The private key never leaves the user's device. What gets sent during sign-in is a signed challenge — bound to the origin (the actual website domain) by the browser and the operating system. A fake site atpasskeybase-secure.com can request a passkey assertion, but the browser will refuse to produce one valid for passkeybase.com. There is no way for the user to be tricked into "handing over" the credential.
No shared secret
The server stores only the user's public key. A database breach exposes nothing useful — public keys are public. There's no "salt your hashes" debate, no rainbow tables, no bcrypt-vs-argon2 angst. The cryptographic root of trust lives in the user's device.
Hardware-backed
On modern devices the private key is held in a secure enclave (Secure Enclave on Apple, StrongBox / TEE on Android, TPM on Windows). It can't be exported, even by malware running on the same device. Use of the key requires a local user gesture — Face ID, Touch ID, Windows Hello, or a security key tap.
One tap
Sign-in is "click the button, glance at the camera, you're in." No typing, no app switching, no waiting for SMS. Conversion-rate data from sites that have rolled out passkeys (Shopify, Amazon, eBay, PayPal) consistently shows 2–6× faster login and 20–30% fewer drop-offs at the auth step.
Standards and compliance
- W3C WebAuthn — passkeys are the W3C-standard browser API. Every major browser implements it.
- FIDO2 / CTAP2 — the FIDO Alliance specs for the credential format and authenticator protocol. PasskeyBase is built on the official FIDO2 stack.
- NIST 800-63B AAL3 — passkeys backed by hardware authenticators satisfy the highest assurance level in the US federal authentication guideline.
- PSD2 SCA — passkeys satisfy "something you have" + "something you are" for European Strong Customer Authentication.
- PCI-DSS v4.0 — phishing-resistant MFA is required for all access to cardholder data environments by March 2025. Passkeys are the easiest way to comply.
- CMMC / FedRAMP / Executive Order 14028 — all explicitly call for phishing-resistant authentication.
"But what about…?"
Shared devices / kiosks
Passkeys still work, just not platform-bound. Use a roaming authenticator (YubiKey, Solo, Feitian) plugged into the kiosk, or use the cross-device "scan QR with phone" flow — the user authenticates with the passkey on their phone and the kiosk receives the assertion over Bluetooth (CTAP 2.2 hybrid transport).
Account recovery
Most platform passkeys are synced by the user's password manager (iCloud Keychain, Google Password Manager, 1Password, etc.) — losing one device doesn't lose the credential. PasskeyBase also supports enrolling multiple passkeys per user (phone + laptop + YubiKey), so a lost device just means using one of the others. Seepasskey management for the multi-key UX.
Users who refuse
You don't have to migrate everyone at once. PasskeyBase works as a second factor on top of your existing login, or as a drop-in for a legacy password field. Run them in parallel and let users opt in. Seepasskeys as 2FA andlegacy password-field shim.
The bottom line
Passwords lose to passkeys on every dimension that matters — security, UX, cost, compliance. The only reason most apps still ship password login is that integrating passkeys is annoying. PasskeyBase fixes that part. Five-minute integration, hosted flows, works alongside whatever you already have.