Monthly passkey authentications managed by Dashlane have nearly doubled year over year, reaching 2.5 million per month in 2026, according to the company's third annual Passkey Power 20 report. The credential security firm analyzed millions of aggregated, anonymized passkey logins between July 2025 and June 2026. Despite strong growth, the report finds that passkeys remain a secondary authentication method rather than the primary way people log in to their accounts.
More than half of Dashlane users—57%—now store at least one passkey, up from 40% the previous year. However, passkeys still represent a minority of total logins on widely used platforms: just 28% of Google logins, 18% on PayPal, 17% on Amazon, and only 8% on eBay. In the business software space, the report noted expansion in applications supporting the login mechanism, with HubSpot and Cisco Duo leading in authentication volume. New entries to the top 20 included HR and payroll platforms isolved HCM and BambooHR, alongside AWS and Dropbox.
According to the report, passkeys offer stronger protection against scammers because there's no password to guess or steal—users authenticate via a device PIN or biometric like a face scan. The technology is cryptographically tied to legitimate websites, and even if those sites were breached, hackers wouldn't gain access to users' private keys, which remain on their devices. That's why organizations like Report Fraud recommend passkeys as one of the most effective defenses against account takeover attacks, the report notes. For businesses, passkeys can protect sensitive corporate data and systems while reducing the password-reset workload for IT support.
The central challenge is closing the gap between passkey support and actual adoption, Dashlane argued. The report outlined four approaches: making passkeys highly visible and easy to use within existing workflows, promoting them as a faster alternative with higher completion rates, starting to remove alternatives like one-time passcodes and passwords, and setting a deadline for mandatory passkey use. Few application developers currently force users to adopt passkeys, though Japanese internet company LY Corporation has announced a spring 2027 deadline for Yahoo Japan users. More companies need to shift from soft adoption to enforcing the change, according to Dashlane CPO Christophe Frenet. "Despite sustained growth, we're not on the other side yet," he said. "There's still more work to be done to make passkeys easier to use, and more companies need to go from soft adoption to enforcing the change, so that passkeys become the main authentication method rather than a secondary one, as they still are today." Enterprises may need to weigh user convenience against IT overhead when deciding whether to mandate phishing-resistant authentication, particularly in sectors where regulatory pressure remains light and legacy systems dominate.