Passkey Login: 4 Decisions to Make Before You Commission a Member System
In mid-October the FIDO Alliance published its latest numbers: roughly 7 billion passkeys are now in use worldwide, and across the 15 major consumer services in its index, more than a third of successful sign-ins already use a passkey — nearly three times faster than other methods. "No password needed" is moving from novelty to expectation. If you're about to commission a member system, an e-commerce back office or an app, passkey login is no longer a trend to watch. It's four decisions you need to make at the spec stage.
After 7 billion passkeys: sign-in is changing generations
A passkey works by unlocking a private key that lives only on your phone or computer, using a fingerprint, face scan or screen lock. The website stores only the public key. There's no password to steal or guess, and a fake site has a very hard time tricking anyone into handing one over.
The big platforms have been moving for two years. In May 2025 Microsoft made new accounts "passwordless by default" — you never set a password at all. FIDO's index shows that 90% of active accounts at participating services are now eligible for passkeys, and 42% of those have one enrolled. Even more telling: 9 of 13 organizations surveyed plan to move to fully passwordless accounts.
For smaller brands this means two things. Customers now use passkeys every day on the big platforms, so coming back to your site to remember a password and wait for an SMS code will feel increasingly dated. The good news: every major browser and mobile OS supports passkeys natively, so the technical barrier is far lower than it used to be.
Decision 1: Is passkey login the front door, or an option buried in settings?
FIDO's report includes a very practical finding. Two participants saw that when the sign-in page showed a password or code field first and the passkey option second, people who had created a passkey still didn't use it. Their fix was a passkey-first sign-in flow.
So your spec should state clearly:
- The default action on the sign-in page: when someone taps "sign in," do they get the device's fingerprint or face prompt first, or a password field?
- When to invite people to create a passkey: right after registration, after their first successful password login, or after checkout. Timing makes a big difference to enrollment.
- Whether passwords stay: most brands will keep a password or email link as a fallback for now, but decide whether it's the lead or the backup.
Decision 2: New phone, lost device — how do customers get back in?
The most common question about passkeys is: what happens when I change phones? Apple, Google and the major password managers now sync passkeys across devices on the same account, but your system still needs to handle the exceptions.
FIDO's upcoming Passkey Rubric — a self-assessment checklist, not a certification — specifically warns against allowing only one passkey per account. Starlink, for example, lets each account hold up to 10. When you commission the build, ask for:
- A member area where people can list, name and remove their passkeys, so they know which devices can sign in.
- An account recovery flow as rigorous as sign-in itself — otherwise attackers simply go through "forgot password."
- Clear identity checks and logging whenever support staff help someone recover an account.
Decision 3: Should staff back offices drop passwords too?
Customer sign-in is improving; staff sign-in is lagging. In July, Yubico and Okta surveyed 1,890 technology and security professionals across nine countries: 43% still sign in to work accounts with a username and password. In the same survey, 44% said their organization had suffered at least one successful AI-driven phishing attack in the past year, and 39% couldn't tell which of two messages was written by AI.
People tend to think phishing targets consumers, but the accounts that can touch orders, refunds and customer data are the admin ones. As we noted in four defenses for company websites in the age of AI-agent attacks, the admin panel is the entry point most in need of hardening. On a tight budget, moving admins to passkeys or hardware security keys first often pays off more than adding passkeys to the storefront alone.
Decision 4: Which numbers tell you it was worth it?
FIDO's report breaks results into measurable metrics you can write straight into your requirements:
- Enrollment rate: how many active members have created a passkey.
- Usage rate: what share of successful sign-ins use a passkey. High enrollment with low usage usually means the sign-in page order is wrong.
- Sign-in success rate and time: across participating services, passkeys consistently beat other methods on both.
- SMS code costs: every participant that shared savings data reported lower SMS OTP costs.
- Account takeovers and support tickets: every participant that measures phishing reported fewer successful attacks after deploying passkeys.
Put these on your admin dashboard and in three months you'll have the data to decide whether to retire passwords altogether.
Sign-in is rarely treated as a brand issue, yet it's the door customers walk through every time they come back. Getting stuck, forgetting a password, waiting for a text that never arrives — all of it gets charged to the brand. AI is making phishing more convincing, which makes secure-and-effortless sign-in a basic requirement: let technology guard the door, and let people design an entrance customers want to return through.
If you're planning a member system or app and want to know the most cost-effective way to add passkey login to your architecture, take a look at our custom development services or talk to us.
Comments