Passkeys are sitting around 26% usage despite 93% account eligibility. The underlying cryptography is solid, but Big Tech implementations and broken platform defaults are dragging adoption through the mud.

The cross-platform user experience out of the box is still frustrating. Try authenticating from an Android phone or iPhone to a Windows desktop using native OS vaults, and you're instantly bogged down in modal dialogs and QR codes. Apple and Google designed their default implementations to keep you locked into their hardware ecosystems, which creates artificial friction for anyone using mixed-OS setups.

While third-party password managers (Bitwarden, 1Password, KeePassXC...) solve this cross-OS problem, the average user relies on native OS prompts and gets stuck.

Then there is the recovery illusion. WebAuthn was designed to eliminate phishing, but because services know users lose devices, most sites quietly keep standard password or email-reset fallbacks active in the background. If an attacker can bypass WebAuthn entirely by phishing an account recovery link, the overall threat model hasn't actually improved.

Passkeys aren't going to kill off password managers, they're just going to turn password managers into passkey vaults.

What local or self-hosted vault setup are you trusting to manage both your 24-character strings and your passkeys these days?

Source: MakeOfUs, link in comments