Despite growing industry momentum behind passwordless authentication, passkeys still account for a minority of logins at some of the world’s largest consumer and business technology platforms, according to new research from credential security leader Dashlane.
The 2026 Dashlane Passkey Power 20, published during Cybersecurity Awareness Month, shows that passkeys account for 28% of measured Google logins, 23% at GitHub, 21% at HubSpot, 6% at Microsoft domains and 4% at OpenAI, among others.
The findings expose a significant gap between the availability of phishing-resistant authentication and its adoption in everyday use. Even Google, which made passkeys the default sign-in option for personal accounts in 2023, records fewer than three in 10 logins using a passkey.
The report is the first to measure passkey adoption relative to total login activity by analyzing millions of aggregated, anonymized global authentications managed by Dashlane over the past year, providing real-world insight into how passkey use is evolving across major online applications.
The challenge of making passkeys the default option
Passkeys are increasingly recognized as an important step toward reducing the risks associated with passwords, including phishing and brute-force attacks, which are becoming cheaper to carry out and more difficult to detect due to AI. However, Dashlane’s research suggests that simply introducing passkey support is not enough to fundamentally change authentication behavior.
While hundreds of services now support passkeys, what separates the top of the ranking from the rest are the product decisions layered on top of that support. The report highlights how Google’s decision to make passkeys the default sign-in option for personal accounts has helped establish it as the leading service in Dashlane’s ranking. HubSpot promotes passkeys across web, mobile and its Outlook Sales Add-In, citing logins four times faster than password-plus-2FA.
“The leaders on our list have taken meaningful steps to make their users safer and should be recognized for their success so far,” said Christophe Frenet, Chief Product Officer at Dashlane. “Our findings show that services need to move beyond treating passkeys as an optional feature and make phishing-resistant authentication the default. The technology is already here. The challenge now is accelerating adoption and reducing the reliance on passwords that continues to expose businesses and their customers to unnecessary risk.”
The findings underline a wider challenge for security teams and technology providers on how to accelerate the transition away from passwords while maintaining a frictionless experience for users. Services that continue to offer password-based sign-in alongside passkeys may retain exposure to credential-based attacks through those legacy credentials. Moving toward phishing-resistant authentication therefore requires more than technical support. It also means making passkeys the simplest and most intuitive option.
Passkey use surges as adoption broadens
Despite the gap between availability and widespread use, the research still reveals substantial momentum across some services. Monthly passkey authentications among Dashlane users have nearly doubled to 2.5 million, while the proportion of users storing at least one passkey has risen from 40% to 57% over the past year.
Several major platforms have experienced particularly rapid growth recently, with passkey authentications increasing 391% at BetMGM, 383% at Experian, 354% at Gusto, 310% at Meta and 218% at Ticketmaster from Q1 to Q2 2026. This increase demonstrates growing use of passkeys across services handling sensitive personal, financial and account information. However, the overall rankings indicate that widespread reliance on phishing-resistant authentication remains some way off.
“Despite sustained passkey growth, we’re not on the other side yet,” added Frenet. “There’s still more work to be done to make passkeys easier to use, and more companies need to go from soft adoption to enforcing the change, so that passkeys become the main authentication method rather than a secondary one, as they still are today.”
For enterprises looking to adopt passkeys in their environment, the findings reinforce the importance of reducing friction in authentication while limiting dependence on credentials that can be weak, reused or stolen.
