Passkey Adoption Statistics 2026: Power 20 – Dashlane

Two years ago, the question about passkeys was who would adopt them.1 Last year, it was how fast.2 This year, with enough data to see a trend rather than a moment, the question has changed to: How far has the transition actually gone?

The answer is more complicated than either optimists or skeptics would like. Passkey authentications have nearly doubled in the last 12 months. Adoption is broadening into sectors that showed no activity last year. And yet, at the domain with the highest percentage of passkey use we measure, roughly seven in ten logins still don’t use a passkey.

That gap between the progress we’ve made in passkey adoption and the tremendous potential remaining is what this report is about.

The stakes haven't moved. According to Dashlane data, the average person now manages more than 300 passwords, and credential abuse remains one of the three most common initial attack vectors.3

Passkeys are still the most credible answer to this problem. Built on FIDO Alliance and W3C standards and leveraging public-key cryptography, they're phishing-resistant by design, impervious to credential stuffing attacks, and don’t require memorization. What's new is that we can finally see where those advantages have translated into real-world use and where they haven't.

The 2026 Dashlane Passkey Power 20 is based on an analysis of Dashlane data encompassing millions of aggregated and anonymized web and mobile passkey authentications globally from July 2025 through June 2026, unless otherwise noted.

Dashlane was the first credential manager to support passkeys across all major platforms, which gives us an unusually clear view of mainstream authentication behavior across consumer and enterprise environments.

This year’s Power 20 ranks domains differently than last year’s.

The 2025 ranking measured each domain’s share of total passkey authentications. That's a volume metric. It answers the question “where does passkey activity concentrate?” It's dominated by scale, which is why a single retailer accounted for nearly 40% of last year’s list.

The 2026 ranking measures the proportion of passkey authentications to total authentications at each domain. That's a penetration rate. It answers a more useful question for this year: Where have passkeys actually displaced passwords?

Volume share largely measures how big a company is. Penetration measures whether the passwordless transition is genuinely happening at a given service, which is the question security leaders benchmarking their own programs actually need answered.

The two rankings are not comparable, and the percentages shouldn’t be read against one another. A domain can generate enormous passkey volume and still convert only a small fraction of its logins. This year’s figures are lower than last year’s because they measure something different, not because adoption slowed. It didn't.

Passkey authentications by Dashlane users have nearly doubled year over year, reaching 2.5 million per month. User adoption has followed a remarkably steady line: Roughly 20 percentage points per year, three years running.

If that trajectory holds, four out of five Dashlane users will store at least one passkey by mid-2027. Because use of Dashlane spans millions of people across consumer and enterprise environments, on every major platform and operating system, this makes it one of the clearest available windows into how mainstream authentication is actually changing.

The most revealing number in this year’s ranking sits at the very top. Google leads the Power 20 at 28%, which means that even at the most passkey-successful major domain we measure, roughly seven in ten logins still don’t use passkeys.

That's the state of passwordless authentication in 2026. Adoption is accelerating, but it's nowhere near finished.

This ranking includes only domains with at least 400,000 total authentications managed by Dashlane over the last year, representing significant login activity. Related domains are totalled together, i.e. Amazon.com and Amazon.fr. Microsoft includes authentications from Microsoft.com, Microsoft Online, and Live.com.

Every domain on this list supports passkeys. So do hundreds of services that didn’t make it. What separates the top of the ranking from the rest are the product decisions layered on top of it.

The leaders made passkeys the visible, obvious, and faster path. Google positions passkeys as a safer and easier alternative to passwords.4 Amazon has found that convenience-focused messaging is more effective than focusing on security.5 HubSpot promotes passkeys across web, mobile, and its Outlook Sales Add-In, citing logins four times faster than password-plus-2FA.6

Rew Islam, Director of Product Innovation, Dashlane

What's most striking about the top of this list is that not one of the ten leading domains mandates passkeys today.

Looking across their implementations, four distinct approaches emerge.

The clearest example of the fourth approach comes from a different corporate entity than the Yahoo properties on this list. LINE Yahoo, the SoftBank-owned company operating Yahoo Japan, has announced plans to end password-only login for Yahoo Japan IDs by spring 2027.13

That scarcity explains the 28% ceiling. Encouragement works—it produced every result on this page—but encouragement has a limit, and the leaders appear to be approaching it.

Business applications are no longer represented by a handful of security-forward outliers. HubSpot (#3) and Cisco Duo (#9) lead as they did last year, but the category has widened considerably. isolved HCM (#10) and BambooHR (#15) put HR and payroll platforms on the list for the first time, AWS (#17) brings cloud infrastructure, and Dropbox (#14) represents file sharing.

HR and payroll is a notable arrival. These systems hold direct deposit details, tax identifiers, and personal records for entire workforces, and they're accessed by employees who aren't security specialists. isolved HCM made passkeys a prominent primary MFA option at login while phasing out weaker methods.11

For B2B platforms, passkeys address two problems at once: Protecting business-critical data and reducing the IT burden of password resets, lockouts, and credential-related support tickets.

Two arrivals on this year’s list signal where passwordless authentication goes next.

Login.gov (#11) brings U.S. federal services onto the Power 20. Its position may become considerably more significant because the U.S. Office of Management and Budget (OMB) has circulated a draft policy that would establish Login.gov as the federal government’s single sign-on service for most public-facing services requiring authentication.14 A passkey implementation reaching that scale would expose a large share of the American public to passwordless authentication, much as Google’s 2023 default decision did for consumers.

OpenAI (#19) is the first AI platform to appear. OpenAI announced passkey support in April as part of its Advanced Account Security program, with passkeys required by default for members of its Trusted Access for Cyber program.15 Thus, the clearest requirement we found anywhere in the dataset applies to a security-sensitive user tier, not the general population.

Last year, we held Google out of the ranking entirely. Its authentication volume dwarfed everything else, and its role as an SSO provider made direct comparison misleading.

This year’s metric removes that problem. A penetration rate doesn’t reward scale, so Google competes on the same terms as everyone else and still finishes first. Its 28% is the strongest evidence available that defaults work. Google made passkeys the default sign-in option for personal accounts in October 2023, and three years later that decision is still producing the highest conversion rate we measure.16

Microsoft appeared at #5 on last year’s fastest-growing chart after making passkeys the default sign-in method for all new accounts in May 2025.17 This year, it arrives on the main ranking at #16.

That trajectory is worth noting for anyone evaluating their own rollout. Default-on decisions don’t create meaningful penetration immediately. They show up as growth first, and convert into sustained share over the following year as the installed base turns over.

Apple’s passkeys historically couldn't leave its ecosystem, which made platform-agnostic credential management difficult for consumers and IT admins alike.

With iOS 26, released in September 2025, Apple introduced support for secure credential portability, allowing users to move passkeys and other credentials between the Apple Passwords app and third-party providers such as Dashlane using Credential Exchange. Google followed their lead. In 2026, Google added support for credential exchange for Google Password Manager on Android.

The practical effect is that passkeys are becoming portable assets rather than platform commitments. For organizations that hesitated on passwordless because of lock-in concerns, that objection has largely been answered.

The Power 20 measures how far each service has come. This ranking measures how fast it's moving. For this analysis, Dashlane examined three-month growth in passkey authentications from Q1 2026 to Q2 2026.

Last year’s fastest-growing domain, Roblox, grew 856% in a quarter. This year’s leader, BetMGM, tops out at 391%.

That decline is a sign of maturity rather than a slowdown. The largest growth numbers come from platforms making a single dramatic move, either switching on passkeys where none existed or mandating them outright. Those wins are finite, and what replaces them is broader and steadier. Even number 20 on this list grew nearly two-thirds in a single quarter.

Growth is no longer concentrated in a few headline movers. Instead, it's distributed across nearly every sector we measure.

Gambling takes the top spot for the first time, and BetMGM's 391% growth reflects a pattern visible throughout this list. Passkey adoption moves fastest where accounts hold money, credentials, or regulated personal data. Online betting accounts contain payment methods and balances, sit under active regulatory scrutiny, and are attractive targets for account takeover.

Finance is the clearest example of that pattern, taking five of twenty slots, which is more than any other category. Experian (383%), SBI Securities (114%), Principal (74%), PayPal (66%), and Klarna (64%) span credit reporting, brokerage, insurance, payments, and buy-now-pay-later.

The finance story has changed shape since last year. In 2025, growth in this sector was driven by dramatic mandates, most visibly Gemini requiring passkeys or authenticator apps for all users. Gemini is not one of the top 20 domains in the first table in this report. This year, there's no equivalent headline. Instead, finance appears across five sub-sectors at once, and while this is less dramatic, it’s considerably more durable.

"Trusting an AI agent with a real transaction means knowing who's behind it and being sure it can only do what that person has allowed," says Andrew Shikiar, Executive Director and CEO of the FIDO Alliance. "Phishing-resistant, open standards are how we give users, merchants, and banks confidence in agent-led transactions."

Andrew Shikiar, Executive Director and CEO, FIDO Alliance

Health and pharmacy is newly prominent, with CVS (132%), MyChart (100%), and Caremark (71%) all placing in the top fifteen. Two of those three, CVS and Caremark, are owned by CVS Health, so this represents two organizations rather than three independent moves.

The timing is notable. The proposed update to the HIPAA Security Rule, which would make multi-factor authentication an explicit requirement rather than a discretionary one, remains unfinished at the federal level.18 Healthcare organizations are moving to phishing-resistant authentication ahead of any mandate