Per the FIDO Alliance, around 5 billion passkeys are now in use and passkey logins succeed about 93% of the time versus about 63% for passwords. Yet 57% of organisations still use a phishable method as their primary sign-in.

Awareness isn't the problem. Implementation is. Here's what shipping passkeys properly actually involves.

How a passkey works (FIDO2 / WebAuthn)

Registration: your server sends a random challenge; the browser calls navigator.credentials.create() ; the authenticator generates a key pair and returns the public key plus a credential ID.

Storage: you store the public key and credential ID against the user.…