The password turned sixty this year, and 2026 is shaping up to be the year it finally started to die.
In early May, on what the security industry now marks as World Passkey Day, the FIDO Alliance reported that more than five billion passkeys are in use around the world, and that adoption is accelerating fast. Ninety per cent of the people it surveyed had heard of passkeys, three quarters had switched one on somewhere, and roughly half now use them whenever a website offers the option. For a technology most New Zealanders could not have named two years ago, that is a remarkably quick trip from novelty to normal.
If you have unlocked your phone to sign in to your bank lately without typing anything, you have almost certainly already used one. A passkey replaces the old idea of a shared secret, the string of characters you invent and a website stores, with a pair of cryptographic keys. The private half never leaves your device and is unlocked by your face, your fingerprint or your screen lock. The public half sits with the website and is worthless to anyone who manages to steal it. The important part is that a passkey is bound to the exact site it was created for, so it simply will not work on a convincing copy. The thing a scammer fishes for in a phishing email, your password, no longer exists to be handed over.
That is why this matters more here than the plumbing alone suggests. New Zealanders lost close to three billion dollars to scams in the past year according to Netsafe’s State of Scams report, and phishing and credential harvesting sit near the top of the National Cyber Security Centre’s quarterly tally of reported incidents quarter after quarter. Almost all of that machinery depends on one weak link, a human being persuaded to type a password into the wrong box. Passkeys do not patch that weakness so much as remove the box. You cannot phish a secret that the customer never knows and never types.
There is a genuine New Zealand story tucked inside all of this. A lot of the passkey experiences Kiwis are quietly using were built by Authsignal, an Auckland company founded in 2021 that now handles sign-ins for Air New Zealand, Trade Me and Hnry, among others. A homegrown firm helping a national airline move its customers off passwords is exactly the kind of digital infrastructure work that rarely makes headlines and quietly underpins everyday life.
Here is the part business owners tend to underrate, and the part that interests me most as someone who builds websites for a living. Passkeys are usually sold as a security upgrade, and they are one. But the stronger argument for most businesses sits on the revenue side. FIDO’s new Passkey Index found that passkeys lifted sign-in conversion by about thirty per cent, and that the average passkey sign-in took 13.6 seconds against 27.5 seconds for a password. Nearly half of people admit they will walk away from a purchase or a login when they cannot remember the password. Anyone who has watched their own checkout analytics knows what that abandonment quietly costs.
Login friction is one of the least glamorous leaks in any online business. A customer who has to stop, hunt for a password, fail, request a reset email, wait for it to arrive and then start again is a customer you may never see complete the sale. Every step you remove from that journey is money you keep. Passkeys remove most of the steps at once, which is why the security benefit and the conversion benefit are really the same thing viewed from two angles.
The good news is that almost none of this is something a small business needs to build from scratch. The heavy cryptography is already handled by the platforms most New Zealand businesses are standing on. Shopify supports passwordless sign-in, WordPress has plugins that add passkeys, and the major identity providers and specialist platforms like Authsignal will bolt the whole experience onto an existing site. For most owners the job is far smaller than it sounds, which is to turn the option on where your platform offers it, and to offer it rather than force it.
None of this means passwords vanish next quarter. Passkeys are not flawless, and account recovery is the genuinely hard part. A customer who loses their only device still needs a safe way back into their account, and that fallback has to be strong enough not to reopen the very door you just closed. Syncing a passkey between an Apple, Google and Microsoft world has improved a great deal but is not yet seamless, and plenty of customers are simply not ready. So the sensible pattern is to offer passkeys as the easy default while keeping a reliable backup method, not to rip passwords out overnight and hope for the best.
The wider shift, though, is happening with or without any single business signing on. Five billion passkeys is not a trend that reverses, and the platforms your customers already live in are nudging them this way every day. The businesses that make signing in feel effortless and safe will quietly win the customers who give up on the ones that do not. For a country that loses billions to scams and runs on small operators competing for every sale, that is a rare case where the safer choice and the more profitable one are the same choice.
Roger McSaveney is General Manager of Forge Creative, an Auckland web design and development agency.
Have you turned on passkeys yet, on your own accounts or on your business website, and how did your customers take to it? Share your experience in the comments below.
This article was written by AI, briefed to report the facts, hopefully without some of the bias people bring to the job 🙂
Leave a Reply