Passkey and WebAuthn adoption in 2026: the world and the Russian web

The spread of passkey figures reflects not disagreement between sources but that they measure different things:

Between "the browser can" and "the site supports" lies a gap of thousands of times, and presenting the first figure in place of the second is the commonest error in this field.

By Chrome telemetry as of 25 August 2026, 0.000671% of page loads complete a WebAuthn authentication — a 30-day mean. The growth is real: 1.72× in a year and 3.08× over two. But the base is near zero, and the denominator is page loads rather than sign-in attempts.

The FIDO Alliance’s most substantive figures come from its October 2025 index across nine large deployments (Amazon, Google, LY, Mercari, Microsoft, NTT DOCOMO, PayPal, Target, TikTok): 93% of accounts are eligible to use a passkey, 36% have created one, and 26% of sign-ins use one.

Beside it sits their consumer survey, "State of Passkeys 2026": fielded April 2026 across 11,000 consumers and 1,400 decision-makers in ten countries, 100% self-report. There, 75% said they had enabled a passkey and 49% that they use them habitually.

Compare: 36% on real accounts against 75% by self-report. The twofold difference is the measure of how far the survey inflates — and the nine deployments in the index are the most advanced part of the market.

Three caveats on FIDO’s figures worth keeping in mind:

• "Five billion passkeys" is an estimate with no methodology. FIDO calls it one itself. It counts credentials, not people, and does not belong in a sentence with the word "users".
• The awareness series 39% → 52% → 57% → 90% is not a trend: the instrument changed, and the 90% is derived from a usage question as a residual.
• The phrase "nearly half the world’s population" refers to 49% of eleven thousand survey respondents.

And separately on the enterprise segment. Okta’s headline that "phishing-resistant authentication grew 63%, from 8.6% to 14.0%" refers mostly to their own proprietary sign-in method, not to passkeys. The WebAuthn line itself moved from 3.0% to 3.2% in a year — essentially unchanged — and that 3.2% includes physical USB keys.

WebAuthn in the Russian web is supported by Yandex ID and VK ID; at Alfa-Bank only in the corporate internet bank; MTS ID has rolled it out across 119 services. Gosuslugi, Sber and T-Bank do not support passkey sign-in.

Exactly one adoption figure has ever been published: 4 million VK accounts with OnePass at the end of 2024 — the figure doubled during 2024, and it is roughly 3.2% of VK ID’s 126 million active users. The source is VK’s press service, 16 January 2025. Company self-report, no methodology, never updated for 2025 or 2026.

Three adjacent numbers must not be mistaken for it: VK’s "50 million used passwordless methods" includes QR codes and one-time codes; Yandex’s "one-and-a-half-fold growth" covers all passwordless methods and has no denominator; MTS’s "one in ten by the end of 2025" is a forecast, not a measurement.

The commonest error in the Russian context is equating passkeys with the state biometric system. That system is a centralised government biometric database — architecturally the opposite of WebAuthn, where the private key never leaves the device and no central database exists at all. These are not two implementations of one idea but two different ideas.

Neither the regulator nor industry researchers measure passkey prevalence in Russia. Russia is also not among the ten countries in FIDO’s survey — so no global figure from it carries any information about the Russian web.

Hand-curated directories converge: passkeys.directory shows 250 entries as rendered and 262 in its backing store; the independent 2factorauth directory has 268. So the order is 260–270 sites.

An academic census (a crawl of the Tranco top 100,000 in March 2025) found 9,397 domains — but 75.2% of them qualify only because they offer "Sign in with Google". There is no passkey support of their own there, only somebody else’s button.

From which follows an unwelcome but honest conclusion: passkey adoption on the open web has been reliably measured by nobody. There are directories covering two hundred and fifty sites, and a census three quarters of which is an artefact of method.

Stale figures are worth knowing too. Google’s most-cited — "a billion authentications across 400 million accounts" — is dated 2 May 2024; Google’s own World Password Day post for 2026 contains no passkey figures at all. Apple has never published an adoption number.

Sources: FIDO Passkey Index, passkeys.directory, the Okta report, the academic census.