ByAhsan NadeemLead Full-Stack Engineer
Should your SaaS product drop passwords? Not yet, but it should offer passkey authentication now and make it the default for new users. Passkeys replace passwords with something people already do dozens of times a day: unlocking their phone with a fingerprint, face or PIN.
In 2026 passkeys are mainstream, and US federal guidance on passwords has changed to match. This guide covers how passkeys work, NIST's new rules, a three-phase rollout and safe account recovery.
What is a passkey and how does passkey authentication work?
Passwords get reused, phished and forgotten, which makes them the weakest part of most products. A passkey is a pair of cryptographic keys created for one website:
- the private key stays on the user's device (or in their password manager), protected by fingerprint, face or device PIN;
- the public key is stored by your website.
At sign-in, your site sends a challenge, the device signs it with the private key once the user unlocks it, and your site checks the signature with the public key. Nothing secret is typed, sent or stored on your servers.
That design brings three advantages:
- Phishing-resistant. A passkey is tied to your real domain, so it won't work on a lookalike phishing site.
- Nothing worth stealing in a breach. Your database holds only public keys, which are useless to an attacker.
- Faster for users. No typing, no remembering, no codes to copy from another app.
Secure sign-in is one of the foundations our SaaS product development service covers, alongside multi-tenancy and admin tooling.
Passkey adoption in 2026
- The FIDO Alliance estimates around 5 billion passkeys are now in use worldwide.
- In its 2026 survey of 11,000 consumers across ten countries, 90% were aware of passkeys, 75% had enabled one on at least one account, and 49% regularly use them when available.
- Among 1,400 enterprise decision-makers, 68% had deployed or were deploying passkeys for employee sign-in, and 28% had reached fully passwordless sign-in for their workforce.
- In May 2025, Microsoft made new consumer accounts passwordless by default.
Apple, Google, Microsoft and the major password managers support passkeys natively, and they sync across a user's devices, so a lost phone no longer means a lost account.
NIST password guidelines: the new rules in SP 800-63B-4
The US National Institute of Standards and Technology (NIST) published SP 800-63B-4, the fourth revision of its digital identity guidelines, in 2025. It's written for US federal systems but widely used as a benchmark. For passwords it now says:
- passwords used on their own must be at least 15 characters;
- services must not impose composition rules (no "must include a symbol and a capital letter");
- services must not force periodic password changes, only when there's evidence of compromise;
- services should allow passwords of at least 64 characters, block commonly used and breached passwords, and allow password managers and pasting.
On passkeys, the guidelines allow syncable authenticators (the kind that sync through Apple, Google or a password manager) at authentication assurance levels 1 and 2, which covers most business software. Only the highest level, AAL3, requires non-exportable keys such as hardware security keys.
In short: long passwords, no arbitrary rules, no forced resets, and phishing-resistant methods like passkeys wherever possible.
Passkeys vs passwords: should you drop passwords entirely?
For most SaaS products, not yet, but make passkeys the default. A practical rollout in three phases:
Phase 1: offer passkeys alongside passwords
- Add "Sign in with a passkey" to the login page.
- After a password sign-in, prompt users to create a passkey ("Sign in faster next time").
- Support autofill (conditional UI), so passkeys appear in the browser's suggestions when the user clicks the email field.
Phase 2: make passkeys the default
- New sign-ups create a passkey first, with a password as an optional extra.
- Show users their sign-in methods and let them add devices.
Phase 3: reduce passwords
- Offer users who have a passkey the option to remove their password.
- Keep a secure recovery path for everyone: the part that needs most care.
Passkey account recovery: the part teams get wrong
Your login is only as strong as your account recovery. If "I lost my passkey" falls back to a single SMS code or a weak email link, attackers will use that door instead.
Good practice:
- encourage users to keep at least two sign-in methods (two devices, or a passkey plus a hardware key);
- make recovery slower and more careful than sign-in: verified email plus a delay, or identity checks for high-value accounts;
- notify users by email whenever a sign-in method is added or removed;
- for business accounts, let administrators reset a team member's access (one reason to get organisations and roles right early in a multi-tenant SaaS architecture).
How to implement passkeys: technical notes
- Passkeys use the WebAuthn standard, built into every modern browser. Don't implement the cryptography yourself: use a maintained server library or your authentication provider's passkey support. Vet that library like any other dependency in your sign-in path (see how npm supply chain attacks work).
- Store several passkeys per user, each with a friendly name ("iPhone", "Work laptop") so users can manage them.
- Test across Apple, Google and Windows devices, and with at least one password manager.
- Measure sign-in success rates and support tickets before and after. Fewer lockouts and password resets are the first wins to look for.
Frequently asked questions
Are passkeys more secure than passwords?
Yes, in the ways that matter most. A passkey won't work on a phishing site, because it's tied to your real domain, and a breach exposes only public keys, which are useless to an attacker.
What happens if a user loses the device that holds their passkey?
Their passkeys sync to their other devices through Apple, Google, Microsoft or a password manager, so they can still sign in. You still need a careful recovery path, and users should keep at least two sign-in methods.
Does NIST allow synced passkeys?
Yes. SP 800-63B-4 allows syncable authenticators at assurance levels 1 and 2, which covers most business software. Only AAL3 requires non-exportable keys such as hardware security keys.
The bottom line
Passkeys are mainstream and backed by the official guidance. For a SaaS product they mean fewer account takeovers, fewer reset tickets and faster sign-ins. Add them alongside passwords now, make them the default for new users, and make recovery as secure as the passkeys.
Planning your product's sign-in? Book a free consultation with our SaaS product development team to talk it through.
Sources
- FIDO Alliance, World Passkey Day 2026 adoption report (May 7, 2026): https://fidoalliance.org/fido-alliance-reports-accelerating-global-passkey-adoption-on-world-passkey-day-2026/
- FIDO Alliance, The State of Passkeys 2026: https://fidoalliance.org/the-state-of-passkeys-2026-global-consumer-and-workforce-report/
- NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management: https://pages.nist.gov/800-63-4/sp800-63b.html
- The Hacker News, "Microsoft Makes Passkeys Default for New Accounts" (May 2025): https://thehackernews.com/2025/05/microsoft-sets-passkeys-default-for-new.html
- W3C, Web Authentication (WebAuthn) specification: https://www.w3.org/TR/webauthn-3/
- passkeys.dev, developer resources: https://passkeys.dev/
