Why native platform implementations (and lazy recovery fallbacks) are stalling passkey adoption at 26%

[u/EnthusiasmRoutine]

Passkeys are sitting around 26% usage despite 93% account eligibility. The underlying cryptography is solid, but Big Tech implementations and broken platform defaults are dragging adoption through the mud.

The cross-platform user experience out of the box is still frustrating. Try authenticating from an Android phone or iPhone to a Windows desktop using native OS vaults, and you're instantly bogged down in modal dialogs and QR codes. Apple and Google designed their default implementations to keep you locked into their hardware ecosystems, which creates artificial friction for anyone using mixed-OS setups.

While third-party password managers (Bitwarden, 1Password, KeePassXC...) solve this cross-OS problem, the average user relies on native OS prompts and gets stuck.

Then there is the recovery illusion. WebAuthn was designed to eliminate phishing, but because services know users lose devices, most sites quietly keep standard password or email-reset fallbacks active in the background. If an attacker can bypass WebAuthn entirely by phishing an account recovery link, the overall threat model hasn't actually improved.

Passkeys aren't going to kill off password managers, they're just going to turn password managers into passkey vaults.

What local or self-hosted vault setup are you trusting to manage both your 24-character strings and your passkeys these days?

Source: MakeOfUs, link in comments

[u/Awkward_Leah]

I think passkeys can be more secure but if a site still let's you reset access through email or a password, that fallback can still become the weakpoint. For mixed devices, I'd rather keep passwords and passkeys synced through one manager. I use roboform rather than depending entirely on each platforms native setup

[u/EnthusiasmRoutine]

Source: https://www.makeuseof.com/are-passkeys-replacing-passwords/

TL;DR for skimmers: Passkey adoption is stuck at 26% despite 93% account eligibility because tech giants turned them into ecosystem traps. Between clunky cross-device UX and weak password recovery fallbacks that leave traditional phishing vectors wide open, password managers aren't going anywhere anytime soon.

[u/stijnhommes]

Passkeys just aren't good enough. Instead of focusing on downgrading all accounts, they should be looking at the people who actually want passkeys and let everyone else opt out even if they are eligible.