“Despite sustained growth, we’re not on the other side yet,” Dashlane CPO Christophe Frenet said, summing up a year of clear progress and lingering gaps in the move away from passwords.
Dashlane’s Passkey Power 20 data
Dashlane’s third annual Passkey Power 20 report, compiled from millions of aggregated, anonymized authentications it managed between July 2025 and June 2026, documents a rapid but incomplete shift. Passkey authentications among Dashlane users nearly doubled year on year, reaching 2.5 million per month in 2026. Meanwhile, the share of Dashlane users who store at least one passkey rose to 57% from 40% a year earlier.
Those figures show momentum: more people are creating and storing passkeys. But Dashlane’s dataset also shows that passkeys remain a minority authentication method on many major consumer platforms.
Major consumer platforms: Google, PayPal, Amazon, eBay
On the largest sites, passkeys remain supplemental rather than dominant. Dashlane found passkeys accounted for 28% of logins on Google, 18% on PayPal, 17% on Amazon and only 8% on eBay. Those percentages underline a familiar pattern from the report: support for the technology is growing, but user behavior and platform defaults still leave passwords and one-time codes in active use.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildEnterprise adoption: HubSpot, Cisco Duo, isolved HCM, BambooHR, AWS, Dropbox
Dashlane reported expansion among business applications supporting passkeys. HubSpot and Cisco Duo led the list in terms of authentication volume, and new entrants to Dashlane’s top 20 included HR and payroll platforms isolved HCM and BambooHR as well as infrastructure and storage providers AWS and Dropbox. For organizations, Dashlane highlights two concrete benefits: passkeys can keep sensitive corporate data and systems safer and reduce the password-reset workload for IT support.
Four tactics Dashlane recommends and a deadline example
Dashlane argues that closing the gap between support and adoption will require deliberate choices by application developers and operators. It recommends four approaches:
- Make passkeys highly visible and easy to use within existing workflows.
- Promote passkeys as a faster alternative to passwords, with higher completion rates.
- Begin removing alternatives such as one-time passcodes and passwords.
- Set a deadline for mandatory passkey use.
The report notes that few application developers are currently forcing users to adopt passkeys, but it does point to a concrete example: Japanese internet company LY Corporation has announced a spring 2027 deadline for Yahoo Japan users to adopt passkeys.
What this means for security teams, enterprises, and end users
- Security teams and IT support: Dashlane frames passkeys as a way to mitigate account takeover attacks and to reduce password-reset workload. Institutions such as Report Fraud recommend passkeys as one of the most effective mitigations against account takeovers, reflecting the technology’s resistance to phishing and credential theft.
- Enterprises and application developers: The report shows progress from vendors such as HubSpot and Cisco Duo and the arrival of HR platforms and infrastructure providers into the top 20, signaling that offering passkeys is becoming standard for both SaaS and core cloud services. Dashlane urges developers to move from soft adoption—making passkeys available—to defaults or enforced use so passkeys become the primary authentication method.
- End users: Passkeys change the login path: instead of typing a password, users authenticate with a device PIN or biometric such as a face scan. Because passkeys are cryptographically tied to legitimate websites and the private key remains on the device, they are much harder for scammers to exploit.
Technically, the report’s short explanation is decisive: there is no password to steal or guess, and even if a website were breached, the attacker would not receive a user’s private key because it stays on the user’s device. That property underpins both Dashlane’s recommendations and outside endorsements like Report Fraud’s guidance.
The facts in Dashlane’s dataset paint a clear moment of transition: adoption is accelerating, support across business applications is expanding, and clear technical advantages exist for users who switch. Yet the numbers on major sites — Google at 28%, PayPal at 18%, Amazon at 17%, eBay at 8% — show how far the shift has to go before passkeys displace passwords as the default.
Christophe Frenet’s call for companies to push beyond optional support to defaults or mandates frames the central question left by the report: will application operators be willing to remove or restrict legacy options such as one-time codes and passwords, and if so, on what timetable? LY Corporation’s announced spring 2027 deadline for Yahoo Japan users offers one model; whether that approach becomes common will determine how quickly the remaining percentage points of login traffic move away from passwords.
