Passwordless login and passkeys: how they work in 2026

In 2025, a wave of brokerage account takeovers hit Japan, and securities firms there began making passkey login mandatory. Passkeys are often described as "login without passwords." That raises a simple question: do they actually stop phishing, where a fake site tricks you into handing over your login details?

 

In this article I look at three things.

 

• What kinds of passwordless login exist

• Why passkeys hold up against phishing

• How far passkeys have spread as of October 2026, and where the weak points are

 

Where I could, I checked numbers and rules against primary sources: the FIDO Alliance, the US NIST, and Japan's Financial Services Agency. When I only found news coverage or secondary sources, I say so.

 

## Four kinds of passwordless login

 

Passwordless login is a general name for ways to prove who you are without typing a password. By how they work, they fall into four groups.

 

• Magic links and email codes: you click a link or type a one-time code sent by email. If your email account is taken over, so is this login, and a fake site can ask you to type the code

• SMS codes: a one-time code goes to your phone number. This is weak against SIM swapping (an attacker taking over your number) and against fake sites that relay the code

• Push approval: you tap "approve" on a notification in a phone app. Attackers can send prompt after prompt until you approve one by mistake, which is called MFA fatigue

• Passkeys (FIDO2/WebAuthn): your device signs a challenge with a key it keeps. The key does not work on a fake site, and the weak points sit around it, not in it

 

 

 

The first three have one thing in common. You pass a code or an approval to the site by hand. If you type the code into a fake site, the attacker can forward it straight to the real one.

 

Passkeys have no "pass it by hand" step. The next section shows why.

 

## How passkeys work

 

### Sign-up and sign-in

 

Passkeys use public-key cryptography. A signature made with a private key can be checked with the matching public key.

 

 

 

Sign-up and sign-in go like this.

 

• At sign-up, your device creates a key pair: a private key and a public key

• Only the public key goes to the service. The private key never leaves the device

• At sign-in, the service sends a challenge, a random value that changes every time

• Your device checks it is you with a fingerprint, face, or PIN, then signs the challenge with the private key and sends it back

 

The service only stores the public key. A leak from the service is not enough to sign in. Unlike a password, there is no shared secret that can be stolen from the service and reused.

 

### Why a fake site gets nothing

 

A passkey is stored together with the domain of the site you registered it on. Under WebAuthn, the web standard for passkeys, the browser checks the domain of the page that is open and only offers passkeys made for that domain.

 

Say the real site is example.com and the fake one is examp1e.com.

 

• Even if you believe the fake site is real, the browser looks for a passkey for examp1e.com

• No passkey exists for examp1e.com, so no signature is made

• An attacker trying to relay the login has nothing to relay

 

The browser compares domains on its own, without relying on the user to notice anything. This is why passkeys are called phishing-resistant.

 

Because the passkey is unlocked with your fingerprint, face, or PIN, one action also checks two factors: the device you have, and that you are you.

 

 

 

## Synced passkeys and device-bound passkeys

 

### Two ways to store the key

 

Passkeys come in two kinds, depending on where the private key lives.

 

• Synced passkeys are copied across your devices through iCloud Keychain, Google Password Manager, 1Password, and similar services

• Device-bound passkeys stay inside a security key such as a YubiKey, or inside a TPM (a security chip in the device), and never leave it

 

Synced passkeys follow you to a new phone. In exchange, they are only as safe as the account that syncs them, such as your Apple Account or Google Account.

 

Device-bound passkeys are the strongest, because the key cannot be copied out. You do need a plan for loss, such as registering a backup key.

 

### How NIST treats them

 

The US National Institute of Standards and Technology (NIST) rates authentication strength in three assurance levels, AAL1 to AAL3. The 2025 revision, SP 800-63B-4, handles synced passkeys this way.

 

• Synced passkeys can export the private key, so they cannot be used at AAL3, the highest level

• They can be used up to AAL2

• At AAL2, the service must offer at least one phishing-resistant way to sign in

 

The same revision changed the password rules.

 

• A password used on its own must be at least 15 characters

• Services must not force character mixes such as "uppercase, number, and symbol"

• Services must not force periodic changes, though they must force a change when there is evidence of a leak

 

If you keep passwords at all, the thinking is now "one long password, kept until it leaks."

 

## How far passkeys have spread

 

On May 7, 2026, the FIDO Alliance, the industry group behind the passkey standards, published new survey results.

 

• An estimated 5 billion passkeys are in use worldwide

• 90% of consumers know about passkeys, and 75% have turned one on for at least one account

• Only 49% use a passkey regularly when one is available

 

For employee sign-in at companies:

 

• 68% of organizations have deployed passkeys or are rolling them out

• 28% have gone fully passwordless

• 57% still rely on phishable methods for everyday sign-in

 

The survey covered ten countries, including Japan, with 11,000 consumers and 1,400 business decision-makers. The 5 billion figure is an estimate that combines public data with the FIDO Alliance's internal data.

 

Most people know about passkeys and many have set one up, but everyday use has not caught up. That is the picture in 2026.

 

## Japan's securities industry made passkeys mandatory

 

### What triggered it

 

In Japan, the securities industry moved first. In 2025, IDs and passwords stolen through fake sites posing as brokerages were used for a large number of unauthorized trades.

 

Japan's Financial Services Agency (FSA) revised its supervisory guidelines on October 15, 2025. An FSA document confirms the following.

 

• The FSA asks brokerages to make phishing-resistant multi-factor authentication mandatory

• The deadline is, in principle, the end of June 2026

• In October 2025, both the number of affected firms and the number of incidents rose again compared with September

 

According to news reports, the requirement covers sign-in, withdrawals, and changes to the withdrawal bank account. The Japan Securities Dealers Association revised its own guidelines along the same lines and published a list of 58 firms that will make multi-factor authentication mandatory.

 

### What the firms did

 

These dates come from the firms' announcements and news coverage.

 

• Nomura Securities made passkeys mandatory in principle from November 29, 2025

• Mizuho Securities has required passkey sign-in for trading, deposits and withdrawals, and account changes since February 9, 2026

• Monex Securities began making passkeys mandatory in stages from January 2026

 

GMO Click Securities announced that it would add passkey sign-in around early summer 2026 and make it mandatory from fall 2026.

 

## Where the standards are

 

### WebAuthn Level 3

 

WebAuthn Level 3 reportedly became a W3C Recommendation, the final stage of a W3C standard, in August 2026. I could not find the W3C announcement itself.

 

Level 3 adds features such as using one passkey across a set of related domains.

 

### Moving passkeys is only half done

 

Moving passkeys from one password manager to another is being specified at the FIDO Alliance in two documents.

 

• CXF defines the data format. It became a Proposed Standard in August 2025

• CXP defines how the data is transferred. One analysis says it has not moved past an October 2024 working draft

 

What works today appears to be app-to-app transfer on the same device, through the operating system. Moving passkeys freely across devices, for example from Apple's or Google's ecosystem to another password manager, is not there yet.

 

## The weak points are around passkeys, not in them

 

The cryptography behind passkeys is built to hold up against fake sites. Every weakness I found in my research sits outside the passkey itself.

 

### Downgrade attacks

 

In August 2025, the security company Proofpoint demonstrated the following attack.

 

• The attacker places a relay site between the user and the real site

• The relay fakes the browser type so that passkeys look unsupported

• Faced with an error, the user picks a weaker option such as an SMS code or an authenticator app code

• The attacker captures that code and the session after sign-in

 

Proofpoint said it had not seen this technique used in real attacks. It only works when the service still offers fallback methods other than passkeys.

 

### Account recovery and adding new devices

 

In May 2026, Google and Microsoft reportedly warned that passkeys alone are not enough if weaker recovery methods remain.

 

News coverage also lists attacks like these.

 

• Tricking a user over the phone into registering the attacker's device as a passkey

• Calling the help desk while posing as the user to get the account recovered

• Taking over a phone number through SIM swapping and abusing SMS recovery

 

At Black Hat USA 2026, the security company SpecterOps reportedly catalogued 39 known ways to defeat passkey authentication. I could not check their materials directly.

 

All of these skip the door that the passkey guards and go through another door instead.

 

## What to get right when you adopt passkeys

 

At the start I asked whether passkeys stop phishing. The answer comes with a condition. A passkey does not work on a fake site. But if other doors are left open, attackers will use them.

 

If you build a service, these points decide how strong your sign-in really is.

 

• If you keep passwords or SMS as fallbacks, your overall strength is set by the weakest door. Plan to turn them off step by step

• Check account recovery and new device registration at least as strictly as sign-in, for example with approval from an existing passkey or with identity documents

 

On key types and migration:

 

• Use device-bound security keys for admins and other high-privilege accounts

• Moving passkeys is still half done, so ask users to register passkeys on more than one device or key

 

When Japan's brokerages made passkeys mandatory, they closed the password door. Whether they also close the recovery and registration doors decides how much passwordless login actually protects people.

 

## Sources

 

• FIDO Alliance, Five Billion Passkeys (World Passkey Day 2026): https://fidoalliance.org/fido-alliance-reports-accelerating-global-passkey-adoption-on-world-passkey-day-2026/

• NIST SP 800-63B-4: https://pages.nist.gov/800-63-4/sp800-63b.html

• Japan FSA document, November 2025 (Japanese): https://www.fsa.go.jp/common/ronten/202511/06.pdf

 

Brokerage announcements and coverage (Japanese):

 

• Mizuho Securities: https://www.mizuho-sc.com/information/20251230_passkey.html

• Monex Securities: https://info.monex.co.jp/news/2026/20260120_03.html

• GMO Click Securities: https://www.click-sec.com/corp/news/info/20260309-01/

• Business Insider Japan on Nomura Securities: https://www.businessinsider.jp/article/2511-what-is-passkey-security/

 

Coverage of the JSDA guidelines (Japanese):

 

• Impress Watch: https://www.watch.impress.co.jp/docs/news/2031496.html

• ITmedia Business Online: https://www.itmedia.co.jp/business/articles/2601/06/news006.html

 

Standards and attack research:

 

• WebAuthn Level 3 overview (PPC Land): https://ppc.land/webauthn-level-3-lets-one-passkey-cover-at-least-five-related-domains/

• Analysis of CXF and CXP status: https://www.youngju.dev/transcribe/2026-07-16-passkey-credential-exchange-half-shipped.en

• Downgrade attack (CyberInsider): https://cyberinsider.com/new-downgrade-attack-threatens-security-of-fido-passkeys/

• Google and Microsoft warning (Dataconomy): https://dataconomy.com/2026/05/11/google-and-microsoft-warn-passkeys-alone-are-not-enough/

• 39 attack methods against passkeys: https://www.gblock.app/articles/passkey-authentication-39-attack-methods-2026