- 01Synced passkeys (WebAuthn) crossed from novel to standard. Major platforms support them, browser implementations are stable, user education is increasingly built into the platforms — production deployment is no longer a research project.
- 02Four-phase rollout: optional second factor, then promoted sign-in (passwordless), then encouraged passkey-first for new users with password fallback for legacy, then phase out password creation entirely for new accounts.
- 03Recovery is the hardest design problem. Synced passkeys help dramatically (the platform syncs to other devices), but a robust recovery flow with strong identity proofing remains essential.
- 04Account-takeover edge case: an attacker with a session can register their own passkey. Detect and mitigate by requiring re-authentication for sensitive operations including credential management, and by alerting the user out-of-band on new credential registration.
Passkeys (synced WebAuthn credentials) have crossed the line from 'novel' to 'standard.' Major platforms support them, browser implementations are stable, and user education is increasingly built into the platforms themselves. Production deployment is no longer a research project.
The deployment phases
- 01Phase 1 — Add passkey as an optional second factor
- 02Phase 2 — Promote passkey to a sign-in method (passwordless)
- 03Phase 3 — Encourage passkey-first for new users; password fallback for legacy
- 04Phase 4 — Phase out password creation for new accounts
The hard parts
Recovery — what happens when a user loses access to their passkey-bearing device? Synced passkeys help dramatically (the platform syncs to other devices), but a robust recovery flow with strong identity proofing remains essential. Account-takeover scenarios — an attacker who has compromised a session adding their own passkey — must be detected and mitigated with re-authentication for sensitive operations.
Cross-platform reality
Passkeys sync within an Apple ID, within Google accounts, within password manager families. They do not yet sync across those ecosystems. Allow users to register multiple passkeys; expect users to do so.