The 2026 Dashlane Passkey Power 20

Two years ago, the question about passkeys was who would adopt them.¹ Last year, it was how fast.² This year, with enough data to see a trend rather than a moment, the question has changed to: How far has the transition actually gone?

The answer is more complicated than either optimists or skeptics would like. Passkey authentications have nearly doubled in the last 12 months. Adoption is broadening into sectors that showed no activity last year. And yet, at the domain with the highest percentage of passkey use we measure, roughly seven in ten logins still don’t use a passkey.

That gap between the progress we’ve made in passkey adoption and the tremendous potential remaining is what this report is about.

The stakes haven't moved. According to Dashlane data, the average person now manages more than 300 passwords, and credential abuse remains one of the three most common initial attack vectors.³

Passkeys are still the most credible answer to this problem. Built on FIDO Alliance and W3C standards and leveraging public-key cryptography, they're phishing-resistant by design, impervious to credential stuffing attacks, and don’t require memorization. What's new is that we can finally see where those advantages have translated into real-world use and where they haven't.

The 2026 Dashlane Passkey Power 20 is based on an analysis of Dashlane data encompassing millions of aggregated and anonymized web and mobile passkey authentications globally from July 2025 through June 2026, unless otherwise noted.

Dashlane was the first credential manager to support passkeys across all major platforms, which gives us an unusually clear view of mainstream authentication behavior across consumer and enterprise environments.

This year’s Power 20 ranks domains differently than last year’s.

The 2025 ranking measured each domain’s share of total passkey authentications. That's a volume metric. It answers the question “where does passkey activity concentrate?” It's dominated by scale, which is why a single retailer accounted for nearly 40% of last year’s list.

The 2026 ranking measures the proportion of passkey authentications to total authentications at each domain. That's a penetration rate. It answers a more useful question for this year: Where have passkeys actually displaced passwords?

Volume share largely measures how big a company is. Penetration measures whether the passwordless transition is genuinely happening at a given service, which is the question security leaders benchmarking their own programs actually need answered.

The two rankings are not comparable, and the percentages shouldn’t be read against one another. A domain can generate enormous passkey volume and still convert only a small fraction of its logins. This year’s figures are lower than last year’s because they measure something different, not because adoption slowed. It didn't.

Passkey authentications by Dashlane users have nearly doubled year over year, reaching 2.5 million per month. User adoption has followed a remarkably steady line: Roughly 20 percentage points per year, three years running.

If that trajectory holds, four out of five Dashlane users will store at least one passkey by mid-2027. Because use of Dashlane spans millions of people across consumer and enterprise environments, on every major platform and operating system, this makes it one of the clearest available windows into how mainstream authentication is actually changing.

The most revealing number in this year’s ranking sits at the very top. Google leads the Power 20 at 28%, which means that even at the most passkey-successful major domain we measure, roughly seven in ten logins still don’t use passkeys.

That's the state of passwordless authentication in 2026. Adoption is accelerating, but it's nowhere near finished.

This ranking includes only domains with at least 400,000 total authentications managed by Dashlane over the last year, representing significant login activity. Related domains are totalled together, i.e. Amazon.com and Amazon.fr. Microsoft includes authentications from Microsoft.com, Microsoft Online, and Live.com.

Every domain on this list supports passkeys. So do hundreds of services that didn’t make it. What separates the top of the ranking from the rest are the product decisions layered on top of it.

The leaders made passkeys the visible, obvious, and faster path. Google positions passkeys as a safer and easier alternative to passwords.⁴ Amazon has found that convenience-focused messaging is more effective than focusing on security.⁵ HubSpot promotes passkeys across web, mobile, and its Outlook Sales Add-In, citing logins four times faster than password-plus-2FA.⁶

What's most striking about the top of this list is that not one of the ten leading domains mandates passkeys today.

Looking across their implementations, four distinct approaches emerge.

The clearest example of the fourth approach comes from a different corporate entity than the Yahoo properties on this list. LINE Yahoo, the SoftBank-owned company operating Yahoo Japan, has announced plans to end password-only login for Yahoo Japan IDs by spring 2027.¹³

That scarcity explains the 28% ceiling. Encouragement works—it produced every result on this page—but encouragement has a limit, and the leaders appear to be approaching it.

Business applications are no longer represented by a handful of security-forward outliers. HubSpot (#3) and Cisco Duo (#9) lead as they did last year, but the category has widened considerably. isolved HCM (#10) and BambooHR (#15) put HR and payroll platforms on the list for the first time, AWS (#17) brings cloud infrastructure, and Dropbox (#14) represents file sharing.

HR and payroll is a notable arrival. These systems hold direct deposit details, tax identifiers, and personal records for entire workforces, and they're accessed by employees who aren't security specialists. isolved HCM made passkeys a prominent primary MFA option at login while phasing out weaker methods.¹¹

For B2B platforms, passkeys address two problems at once: Protecting business-critical data and reducing the IT burden of password resets, lockouts, and credential-related support tickets.

Two arrivals on this year’s list signal where passwordless authentication goes next.

Login.gov (#11) brings U.S. federal services onto the Power 20. Its position may become considerably more significant because the U.S. Office of Management and Budget (OMB) has circulated a draft policy that would establish Login.gov as the federal government’s single sign-on service for most public-facing services requiring authentication.¹⁴ A passkey implementation reaching that scale would expose a large share of the American public to passwordless authentication, much as Google’s 2023 default decision did for consumers.

OpenAI (#19) is the first AI platform to appear. OpenAI announced passkey support in April as part of its Advanced Account Security program, with passkeys required by default for members of its Trusted Access for Cyber program.¹⁵ Thus, the clearest requirement we found anywhere in the dataset applies to a security-sensitive user tier, not the general population.

Last year, we held Google out of the ranking entirely. Its authentication volume dwarfed everything else, and its role as an SSO provider made direct comparison misleading.

This year’s metric removes that problem. A penetration rate doesn’t reward scale, so Google competes on the same terms as everyone else and still finishes first. Its 28% is the strongest evidence available that defaults work. Google made passkeys the default sign-in option for personal accounts in October 2023, and three years later that decision is still producing the highest conversion rate we measure.¹⁶

Microsoft appeared at #5 on last year’s fastest-growing chart after making passkeys the default sign-in method for all new accounts in May 2025.¹⁷ This year, it arrives on the main ranking at #16.

That trajectory is worth noting for anyone evaluating their own rollout. Default-on decisions don’t create meaningful penetration immediately. They show up as growth first, and convert into sustained share over the following year as the installed base turns over.

Apple’s passkeys historically couldn't leave its ecosystem, which made platform-agnostic credential management difficult for consumers and IT admins alike.

With iOS 26, released in September 2025, Apple introduced support for secure credential portability, allowing users to move passkeys and other credentials between the Apple Passwords app and third-party providers such as Dashlane using Credential Exchange. Google followed their lead. In 2026, Google added support for credential exchange for Google Password Manager on Android. 

The practical effect is that passkeys are becoming portable assets rather than platform commitments. For organizations that hesitated on passwordless because of lock-in concerns, that objection has largely been answered.

The Power 20 measures how far each service has come. This ranking measures how fast it's moving. For this analysis, Dashlane examined three-month growth in passkey authentications from Q1 2026 to Q2 2026.

Last year’s fastest-growing domain, Roblox, grew 856% in a quarter. This year’s leader, BetMGM, tops out at 391%.

That decline is a sign of maturity rather than a slowdown. The largest growth numbers come from platforms making a single dramatic move, either switching on passkeys where none existed or mandating them outright. Those wins are finite, and what replaces them is broader and steadier. Even number 20 on this list grew nearly two-thirds in a single quarter.

Growth is no longer concentrated in a few headline movers. Instead, it's distributed across nearly every sector we measure.

Gambling takes the top spot for the first time, and BetMGM's 391% growth reflects a pattern visible throughout this list. Passkey adoption moves fastest where accounts hold money, credentials, or regulated personal data. Online betting accounts contain payment methods and balances, sit under active regulatory scrutiny, and are attractive targets for account takeover.

Finance is the clearest example of that pattern, taking five of twenty slots, which is more than any other category. Experian (383%), SBI Securities (114%), Principal (74%), PayPal (66%), and Klarna (64%) span credit reporting, brokerage, insurance, payments, and buy-now-pay-later.

The finance story has changed shape since last year. In 2025, growth in this sector was driven by dramatic mandates, most visibly Gemini requiring passkeys or authenticator apps for all users. Gemini is not one of the top 20 domains in the first table in this report. This year, there's no equivalent headline. Instead, finance appears across five sub-sectors at once, and while this is less dramatic, it’s considerably more durable.

"Trusting an AI agent with a real transaction means knowing who's behind it and being sure it can only do what that person has allowed," says Andrew Shikiar, Executive Director and CEO of the FIDO Alliance. "Phishing-resistant, open standards are how we give users, merchants, and banks confidence in agent-led transactions."

Health and pharmacy is newly prominent, with CVS (132%), MyChart (100%), and Caremark (71%) all placing in the top fifteen. Two of those three, CVS and Caremark, are owned by CVS Health, so this represents two organizations rather than three independent moves.

The timing is notable. The proposed update to the HIPAA Security Rule, which would make multi-factor authentication an explicit requirement rather than a discretionary one, remains unfinished at the federal level.¹⁸ Healthcare organizations are moving to phishing-resistant authentication ahead of any mandate to do so, not in response to one.

Patient portals hold prescription histories, insurance details, and payment methods, and they're used by a population spanning every level of technical comfort. That combination makes the adoption numbers here more impressive than the raw percentages suggest.

Gusto’s 354% growth is the third-highest figure on this list, and it echoes the strong showings of isolved HCM (#10) and BambooHR (#15) on the Power 20 list above.

HR and payroll platforms are converging on passkeys from both directions at once, demonstrating rapid growth and high penetration. These systems hold direct deposit details, tax identifiers, and complete personnel records, while being accessed by employees who log in infrequently and may have no security training. Passwords perform badly under exactly those conditions.

Meta (310%) and X (112%) post strong numbers, but neither leads in the way social platforms did in previous years. The sectors now setting the pace are those with direct financial or regulatory exposure, which suggests passkey adoption is being driven by risk calculation rather than by consumer technology trends.

Air France (69%), Mon Identifiant SNCF (68%), Ticketmaster (218%), and Petco (101%) show continued consumer momentum in Europe and North America. Broadcom (80%) and Trimble (67%) bring semiconductors and industrial technology onto the list for the first time.

The breadth is the point. Nineteen distinct categories appear across this year’s two rankings. Passkey adoption is no longer a story about one sector leading and others following.

Two years ago, we reported early momentum. Last year, we reported that momentum had become a mandate. This year’s data supports a more precise conclusion, and a more demanding one.

Passkey authentications have nearly doubled. Adoption has climbed about twenty points a year for two consecutive years. Nineteen categories are represented across our two rankings, from federal identity services to payroll platforms to patient portals. No serious observer can now argue that passkeys are an early-adopter technology.

And yet, the best-performing major domain we measure has just a 28% passkey login rate. The leaders got there through persuasion, meaning better placement, faster flows, clearer benefits, and the gradual retirement of weaker alternatives. Every one of those decisions worked, but none of them finished the job.

The organizations at the top of this list have demonstrated that passkeys can be deployed at scale across every kind of user base without forcing anyone. They've also demonstrated the ceiling that approach reaches.

For IT and security leaders, the strategic question has changed accordingly. It's no longer whether to support passkeys, or even whether to promote them. It's how far an organization is willing to go in retiring the password alongside them, and on what timeline. The services that answer that question first will be the ones that appear at the top of these rankings next year.

With credential abuse still one of the most common initial attack vectors, the cost of stopping halfway is measured in the attack surface that remains. A passkey offered alongside a password removes very little risk, but a passkey that replaces one removes a great deal.

At Dashlane, we’ll continue tracking this transition and reporting what the data shows, including the parts that are less comfortable. The 2026 Passkey Power 20 captures an industry that has proven passwordless authentication works. What comes next is the harder work of finishing it.