A glance at your phone, a fingerprint on the sensor, and the door opens. No password to invent, remember or type: passkeys promise simpler, more secure sign-ins. But lose that phone, share your computer or switch ecosystems, and the process becomes less straightforward. Understanding the issues facing September 2026 means distinguishing established technical advances from developments that remain uncertain. This analysis draws on documented deployments and standards, without assuming that every obstacle will have disappeared by then.
A genuine breakthrough against phishing
A passkey relies on a pair of cryptographic keys. The service holds the public key; the private key remains under the control of an authenticator, such as a phone, computer or security key. To sign in, users unlock that authenticator with their local PIN or a biometric mechanism. Their fingerprint or face is not transmitted to the website.
The difference from a password is fundamental: no reusable secret is entered into a form. FIDO and WebAuthn mechanisms bind authentication to the legitimate service. A fake page impersonating a bank therefore cannot simply capture the passkey and reuse it elsewhere. This is a major advance against campaigns that steal passwords and one-time codes.
Apple, Google and Microsoft have begun this transition, while services such as Amazon and WhatsApp announced support as early as 2023. But these initial waves do not mean that every user journey has become entirely passwordless. Account creation, recovery and access from an unfamiliar device often remain distinct experiences.
A lost phone is the system’s ultimate test
The scenario seems ordinary enough: a smartphone breaks down the day before a trip. With a password, users expect to regain access from memory, even if they may lack a second factor. With a passkey, their first question becomes: where is my key? The answer depends on how it is stored.
Some passkeys are synced by a manager, such as Apple’s Keychain or Google Password Manager, across the same user’s compatible devices. Others remain tied to a specific authenticator. A synced passkey can survive the loss of a device; a key tied exclusively to that device requires a backup solution. Yet this distinction is rarely clear during registration.
Syncing also shifts part of the problem elsewhere. Users must regain access to the account that protects the vault containing their passkeys. Trusted devices, unlock codes, recovery procedures: requirements vary by provider and configuration. A system can be robustly secured while remaining difficult to understand under stress.
The fallback must not become the main entry point for fraudsters
A website may retain recovery through email, SMS or human support. This is essential to prevent permanent lockouts, but an overly permissive fallback can bypass the passkey’s protection. Attackers no longer need to defeat the cryptography: they try to hijack the email account or persuade support staff.
Conversely, extremely strict recovery procedures risk locking out the legitimate owner. Striking a balance requires several risk-appropriate options: registering a second authenticator, providing recovery codes stored offline or arranging enhanced verification. A bank, a shop and a forum will not necessarily need the same approach.
Shared devices disrupt familiar routines
On a personal phone, the action feels natural. On the living-room computer used by three people, it becomes ambiguous. Which profile is open? Who owns the key vault? Who knows the unlock code? A passkey alone cannot fix poorly separated sessions and accounts.
This point needs to be explicit: on a given device, local verification authorizes use of the key according to that device’s rules. It does not magically prove to the remote service which family member is sitting in front of the screen. Sharing an unlocked session or its code can therefore weaken the privacy of accessible accounts.
Signing in from someone else’s computer can also rely on a personal phone, notably through a QR code and a Bluetooth proximity mechanism. This cross-device authentication avoids storing the passkey on that computer. But it requires an available phone, compatible features and understandable instructions. In a library or workshop, those conditions are not always met.
A shared standard, not a uniform experience
Passkeys benefit from common standards. Yet compatibility does not mean perfect interchangeability. One browser may recognize the protocol without offering the same manager, screens or recovery options as another. Behavior also depends on the operating system, its version and the organization’s policies.
Moving from an iPhone to an Android phone illustrates this difference. Being able to use a key stored on an old phone for a one-off sign-in is not the same as transferring it permanently to a new vault. Cross-device authentication and credential portability address two distinct needs, often conflated in claims about simplicity.
In October 2024, the FIDO Alliance published draft specifications designed to secure the exchange of credentials, including passkeys, between providers. This is a concrete response to the risk of being locked into a particular manager. Looking ahead to September 2026, the question is how effectively they will be implemented: which vaults will support transfers, with what safeguards and what continuity of use? An announced standard does not guarantee universal migration.
The transition hinges on the details
For services, adding a button is not enough. They need to explain where the key will be stored, allow users to add several and display an understandable list of access credentials. Labels such as “personal phone” or “backup key” are more helpful than a creation date alone. Users must also be able to revoke a lost device easily.
Above all, services need to test difficult situations, not just the ideal sign-in: replacing a phone, switching managers, an employee leaving, a shared workstation. Keeping a password can ease the transition, but its presence, along with other sign-in methods, must be factored into the overall risk assessment.
What now? Widespread passkey adoption will depend less on another biometric demonstration than on understandable recovery, better-managed shared devices and reliable transfers between vaults. If progress is made on these fronts, September 2026 could mark a step toward phishing-resistant authentication becoming routine. Otherwise, passwords will survive primarily as a safety net: precisely where fraudsters will continue looking for an opening.
