A new benchmark report from Corbado suggests that the biggest barriers to passkey adoption are no longer technical readiness or browser support, but operational friction, desktop user experience, and persistent misconceptions inside enterprise security teams.
Released around World Passkey Day, Corbado’s Passkey Benchmark 2026 argues that the industry has entered a new phase in the transition away from passwords. Most major consumer platforms are now technically capable of supporting passkeys at scale, the report says, but strong adoption still depends on whether organizations can successfully guide users through enrollment and repeated login flows.
The report frames passkey adoption as a three-layer problem involving readiness, creation, and usage. According to Corbado, ecosystem readiness is already approaching saturation on several major platforms, with iOS web reaching roughly 99 percent readiness by the end of 2025, Android at 97 percent, and macOS at 91 percent.
Support for advanced WebAuthn browser capabilities has also become widespread. Corbado found that browser support for Conditional Get, Hybrid Transport, and Related Origins now approaches universal availability across modern browsers.
Those numbers challenge one of the most common enterprise assumptions surrounding passkeys: that the ecosystem is still too immature for large-scale deployment.
In comments shared with ID Tech ahead of World Passkey Day, HYPR CEO and co-founder Bojan Simic described that belief as increasingly outdated.
“This misconception was partially true in 2022, when passkey support was mostly limited to consumer apps built by Apple and Google,” Simic said. “That world no longer exists.”
Simic pointed to growing enterprise support from identity providers including Okta, Microsoft Entra, Ping, and HYPR itself, arguing that many organizations are still evaluating passkeys using assumptions formed several years ago, before enterprise-grade deployment and management tools matured.
Corbado’s data suggests, however, that technical readiness alone does not translate into smooth deployment outcomes.
One of the clearest findings in the benchmark involves desktop authentication friction, particularly on Windows systems. Corbado found that identifier-first passkey login success rates on Windows 10 and 11 remain between 45 and 60 percent, far below the rates seen on mobile platforms.
The problem is closely tied to cross-device authentication (CDA), where desktop users scan a QR code with a mobile device in order to complete a login. According to the report, between 55 and 65 percent of successful identifier-first passkey logins on Windows 11 still require that phone bridge step.
“Every Windows session without a remembered local passkey pays that cost again,” Corbado wrote in the benchmark.
That operational complexity helps explain why many organizations remain cautious even as the ecosystem matures. One of the most persistent fears surrounding passkey deployment is the concern that users who lose their devices could become permanently locked out of their accounts.
Simic argued that this concern misunderstands how enterprise passkey deployments are actually structured.
“In practice, organizations deploy passkeys alongside layered account recovery flows: backup codes, secondary enrolled authenticators, helpdesk-verified re-enrollment, or synced passkeys across trusted devices,” he said. “The recovery problem is a solved problem.”
Corbado’s benchmark repeatedly emphasizes that the success of passkey deployments increasingly depends on operational decisions surrounding recovery, device recognition, and user onboarding rather than the underlying cryptography itself. The report found that once a device becomes recognized and locally enrolled, authentication success rates rise dramatically to between 95 and 99 percent.
The challenge is getting users to that point in the first place.
Corbado’s enrollment data shows large differences in first-time passkey creation success depending on platform and context. On iOS web, first-time enrollment rates can reach as high as 83 percent, while Windows web enrollment rates range from just 25 to 39 percent.
The benchmark also found that enrollment success drops sharply when users are prompted a second time, suggesting that timing and onboarding design have an outsized impact on adoption. That focus on deployment strategy aligns closely with another misconception Simic identified: the belief that passkeys inherently create more user friction than passwords and traditional MFA.
“The experience data is consistent: users prefer passkeys,” Simic said, citing faster login experiences and the elimination of passwords and SMS codes.
According to Simic, organizations that struggle with passkey adoption are often facing communication and rollout problems rather than flaws in the authentication model itself. “The organizations that struggle with adoption almost universally share one trait: they deployed without communicating the why,” he said.
Corbado’s benchmark also highlights how heavily the ecosystem is consolidating around a small number of passkey providers. The company estimates that iCloud Keychain accounts for between 44 and 69 percent of stored passkeys globally, while Google Password Manager accounts for another 21 to 33 percent. This concentration has contributed to another enterprise concern: whether passkeys leave organizations dependent on Apple or Google ecosystems.
“This is the vendor lock-in fear dressed up as a security concern,” Simic said. “Passkeys don’t have to live in iCloud. They can live in your infrastructure, governed by your policies, visible in your audit logs, and revocable by your administrators.”
The result is a more mature, but also more demanding, phase of passkey adoption. The industry debate is shifting away from whether passkeys are technically viable and toward questions of operational execution: how organizations manage onboarding, recovery, desktop friction, and enterprise policy control at scale.
“The question regulated industries should be asking isn’t ‘can we use passkeys?’” Simic said. “It’s ‘how long can we justify not using them?’”
–
By Ali Nassar-Smith and Alex Perala
