Passkeys still missing from 24% of top websites, new index shows

Twenty-four percent of the world’s most popular websites still do not support passkeys, leaving millions of everyday logins tied to passwords that can be stolen, reused or phished. The shortfall is especially visible on big consumer platforms, where Instagram, Netflix and Spotify remain among the sites without passkey support.

Passkeys.directory is keeping a public tally of where the technology has landed. The community-driven index lists websites, apps and services that offer sign-in with passkeys, and it now includes a request form so users can ask for missing sites to be added to its voting and listing system. That makes the gap more than an abstract adoption metric: it gives users a way to press the companies they rely on most to move faster.

The security case for the technology is straightforward. The FIDO Alliance describes passkeys as a phishing-resistant sign-in method and a true password replacement, and says they are the only practical phishing-resistant option for consumer logins. Its 2024 independent survey found that 53% of people had enabled passkeys on at least one account, while 22% said they had enabled them on every account they possibly could. In its 2026 report, FIDO said 90% of consumers were familiar with passkeys and 75% had enabled them on at least some accounts.

The scale is now global. On May 7, 2026, FIDO said an estimated 5 billion passkeys were in active use worldwide. The alliance’s public passkeys directory also shows 161 results for passkey implementations, underscoring that support is spreading across consumer and workforce services even as many major sites still lag.

The lag is not new. In May 2024, FIDO said 20% of the world’s top 100 websites supported passkeys. A separate independent site, Why No Passkeys?, says 7 of the top 25 global websites still do not support them, naming Instagram, Netflix, Spotify, Samsung, Roblox and Baidu among the holdouts. The persistence of those names at the top of the market points to the real obstacle now: not whether passkeys work, but why some of the most heavily used platforms still have not made them the default path for users who want to leave passwords behind.