Passkeys aren't experimental anymore. Apple, Google, and Microsoft sync them. Banks ship them. If your app still leads with email + password + SMS OTP, you're paying for support tickets, credential stuffing, and drop-off that competitors already cut.
What a passkey actually is
A passkey is a WebAuthn credential: a public key on your server, a private key on the device (or in iCloud / Google Password Manager). The user proves possession with Face ID, Touch ID, Windows Hello, or a hardware key. Nothing secret is typed. Nothing reusable is stolen in a fake login page.
"If your login page can be cloned and still collect something useful, it isn't modern auth." — security review note
Rollout that doesn't strand existing users
- Add passkeys next to passwords. Don't rip email login on day one.
- Prompt after a successful password login. “Save a passkey for next time?” Conversion is highest here.
- Make passkey the default on new signups on iOS 18+, Android 14+, current Chrome/Safari.
- Keep a fallback: magic link or authenticator app — not SMS if you can avoid it.
- Account recovery is the hard part. Design it before you launch. Lost phone ≠ lost business.
Password reset is often 20–40% of small-product support. Passkeys don't delete recovery — they delete the weekly “forgot password” loop.
Implementation notes we keep hitting
- Relying Party ID must match your production domain. Staging vs prod credentials don't mix.
- Discoverable credentials (resident keys) enable usernameless login. Worth it for consumer apps.
- Conditional UI in Chrome/Safari autofills passkeys like passwords. Wire
autocomplete="webauthn". - Native apps: use associated domains / Digital Asset Links so the same passkey works on web + iOS + Android.
- Don't invent crypto. Use SimpleWebAuthn, Corbado, Clerk, Auth0, or your IdP's passkey product.
When passwords still belong
Shared kiosk accounts, some enterprise SSO-only tenants, and extremely old WebViews. Even then, treat password as a compatibility shim with rate limits, breach checks, and no SMS as the only 2FA.
The product copy that actually converts
Don't say “WebAuthn.” Say “Sign in with Face ID — no password to remember.” Show the platform sheet immediately. If you bury passkeys under “More options,” adoption stays a rounding error.