The Password Is Dead, Long Live the Passkey (Except Nobody Actually Switched)

Sep 11

# The Password Is Dead, Long Live the Passkey (Except Nobody Actually Switched)

Passkeys have been available on every major platform for years now — phishing-resistant, immune to credential-stuffing attacks, backed by every operating system and most major websites that matter. By every objective security measure, they're a straightforward improvement over passwords in almost every way a password can fail. Adoption is still a fraction of what the technology's own advocates predicted years ago. The bottleneck was never the cryptography.

## The Technology Actually Works

It's worth being clear about this before getting to the failure: passkeys solve real, well-documented problems that passwords have never solved. They can't be phished, because the cryptographic exchange is tied to the specific website's actual domain rather than to a string of characters a fake login page can simply ask you to type in. They can't be reused across a breach, because there's no shared secret sitting in a database somewhere waiting to be stolen and tried against other accounts. They eliminate the entire category of credential-stuffing attacks that passwords structurally enable. On every technical merit that security professionals care about, the case for passkeys over passwords isn't close.

## So Why Didn't Everyone Switch

The gap between "technically superior" and "actually adopted" is where this gets interesting, and the reasons are almost entirely about experience rather than capability. Setting up a passkey requires understanding a new mental model — no more memorizing or typing a secret, instead relying on a device you have and, often, a biometric you provide — and that conceptual shift is a bigger ask than it sounds for people who've spent decades building a stable, if flawed, mental model around passwords. Cross-device and cross-platform passkey syncing, while improving, has historically been inconsistent enough that people who set up a passkey on one device sometimes found themselves locked out on another, which is precisely the kind of bad early experience that poisons trust in a new system regardless of how sound the underlying design is.

## Habit Inertia Beats Objective Improvement

There's a broader pattern here that shows up across a lot of technology adoption, not just security: being measurably better doesn't guarantee displacement of an entrenched habit, especially when the entrenched habit, however flawed, is at least fully understood by the people using it. Passwords are annoying, frequently reused unsafely, and responsible for a huge share of account breaches — but everyone already knows exactly how they work, including exactly how they fail, which is a strange kind of comfort that a demonstrably better but less familiar system has to overcome. The switching cost isn't really technical. It's the cognitive cost of replacing a fully internalized habit with a new one, even a strictly better one, and that cost gets underestimated constantly by people building the better system.

## The UX Failures Nobody Wants to Admit

Part of the slow adoption is a genuine design problem the industry has been slow to own. Early passkey implementations varied significantly across platforms and websites in how they explained what was happening, what to do if you lost your device, and how recovery worked when something went wrong — and inconsistent, sometimes confusing recovery flows are exactly the failure mode that erodes trust fastest in a security system, because a security system that fails you at the moment you most need it to work is worse than useless. A password, whatever its flaws, at least fails in familiar, well-understood ways. A passkey failing unpredictably during account recovery is a worse first impression than the marginal security cost passwords carry every day without most users ever noticing.

## Where Adoption Is Actually Working

The exceptions are instructive. Adoption tends to be meaningfully higher in contexts where the switch happened without requiring the user to make an active decision at all — platforms that quietly default new accounts to passkeys, or that prompt at the exact moment a password would otherwise need to be created, rather than asking an existing user to proactively go find a settings menu and opt in to something unfamiliar. That pattern matches a much older lesson about technology adoption generally: the switch that works is rarely the one that asks people to change their behavior through willpower and understanding. It's the one that changes the default and lets habit do the rest of the work automatically.

## Takeaway

Passkeys are a case study in a pattern that shows up constantly in technology adoption: solving the hard problem — building a genuinely superior cryptographic system — turned out to be easier than solving the soft problem of getting people to trust and adopt something unfamiliar, however demonstrably better it is. The password isn't dead because the alternative to it isn't good enough. It's still alive because good enough was never really the

The Password Is Dead, Long Live the Passkey (Except Nobody Actually Switched)

Beyond the Script: Engineering the Autonomous AI Workflow

Own the Silicon: The Rise of the Sovereign Local AI Rig

Your Site Title

email@example.com