Passkey authentications among Dashlane users have almost doubled to 2.5 million a month, but passwords still account for most logins at major online services, according to a new industry assessment.
Dashlane's 2026 Passkey Power 20 report, released on Tuesday, found that 57% of its users now store at least one passkey, up from 40% in 2025. Yet passkeys represented only 28% of measured Google logins, the highest proportion among the major domains examined.
The findings highlight a distinction between creating a passwordless credential and routinely using one. Even services that have introduced passkeys and encouraged customers to adopt them continue to handle most authentication through other methods.
GitHub ranked second with passkeys accounting for 23% of measured authentications, followed by HubSpot at 21%. The corresponding proportions were 6% for Microsoft domains and 4% for OpenAI, Dashlane said. The figures describe activity observed through Dashlane rather than every login processed by those companies.
The report examined millions of aggregated, anonymised web and mobile authentications globally between July 2025 and June 2026. Its main ranking includes domains recording at least 400,000 total authentications managed by Dashlane during that period, limiting comparisons to services with substantial observed activity.
Dashlane changed its ranking methodology this year. Instead of measuring each website's share of overall passkey traffic, it calculated passkey authentications as a proportion of all authentications at that domain. Consequently, this year's rankings cannot be compared directly with last year's positions.
Monthly passkey authentications stood at 1.3 million in 2025 and 200,000 in 2024. The proportion of Dashlane users storing a passkey was 20% in 2024, rising to 40% the following year and 57% in 2026. Those figures indicate expanding adoption within the company's user base, not an equivalent global penetration rate.
Christophe Frenet, Dashlane's chief product officer, said providers needed to move beyond encouraging customers to use passkeys and make them the principal authentication method. None of the ten leading domains in the company's ranking currently requires passkeys, leaving password-based access available alongside the newer technology.
Passkeys use public-key cryptography to authenticate users without transmitting a reusable password. They are designed to resist conventional phishing attacks because credentials are tied to the legitimate website or application. Authentication can typically be authorised using a device's biometric verification or screen-lock mechanism.
The report also identified rapid quarterly increases in passkey activity across several services. Between the first and second quarters of 2026, measured authentications rose 391% at BetMGM, 383% at Experian, 354% at Gusto, 310% at Meta and 218% at Ticketmaster.
Such growth rates measure changes in authentication volumes over three months, rather than the share of customers who have abandoned passwords. A platform starting from a smaller passkey base can record a substantial percentage increase without making passkeys its dominant login method.
Business software featured more prominently in Dashlane's assessment, including human resources and payroll providers isolved HCM and BambooHR, cloud platform AWS and file-sharing service Dropbox. Their appearance broadens the range of applications where passkey authentication is being used, including systems handling sensitive workplace information.
Google introduced passkeys as the default sign-in option for personal accounts in 2023, while Microsoft made passwordless sign-in the default for new accounts in 2025. Dashlane said such changes can encourage adoption, although their effects emerge gradually as account holders begin using the newer login process.
Separately, the FIDO Alliance said in May that five billion passkeys were in active use globally. Its survey of 11,000 consumers across ten countries found 75% had enabled passkeys on at least some accounts. The survey measures consumer adoption differently from Dashlane's observed authentication activity and should not be treated as an equivalent login statistic.
The FIDO Alliance also surveyed 1,400 workplace decision-makers and found 68% of organisations were deploying, piloting or rolling out passkeys for employees. However, 57% continued relying on authentication methods vulnerable to phishing for primary everyday workforce access, underscoring the difference between introducing stronger credentials and replacing existing sign-in arrangements.
The company also identified secure credential portability as a practical improvement, citing support for transferring passkeys between password managers on newer mobile operating systems, reducing dependence on individual providers.
Dashlane's analysis covered both consumer and enterprise environments and combined related domains when calculating authentication shares. Microsoft, for example, included activity across Microsoft. com, Microsoft Online and Live. com, rather than treating each address as a separate service.
the blog