State of Passkey Authentication in the Wild: A Census of the Top 100K sites

2026-02-16

AI Summary

This study addresses the lack of large-scale, systematic measurement of Passkey authentication deployment across the web. The authors propose Fidentikit, the first multidimensional heuristic framework for detecting Passkey support, which integrates browser automation, DOM analysis, WebAuthn API monitoring, network traffic pattern recognition, and third-party library detection. Leveraging 43 heuristic rules, Fidentikit conducts a comprehensive census of Passkey adoption among the top 100,000 websites in the Tranco list. The approach effectively overcomes challenges posed by the heterogeneity of Passkey implementations and the dynamic nature of modern web pages. Findings reveal a strong positive correlation between website popularity and Passkey adoption, with the vast majority of deployments relying on external identity providers rather than native implementations.

Technology Category

• Application Domains: Security
• Data Mining & Knowledge Management: Knowledge Acquisition from the Web
• Search and Optimization: Heuristic Search

Application Category

• Responsible Web: Consent frameworks and practices on the web
• Security and Privacy: Large-scale security measurements
• Web Mining and Content Analysis: Web data provenance, reliability, and authenticity

Abstract

Passkeys -- discoverable WebAuthn credentials synchronised across devices are widely promoted as the future of passwordless authentication. Built on the FIDO2 standard, they eliminate shared secrets and resist phishing while offering usability through platform credential managers. Since their introduction in 2022, major vendors have integrated passkeys into operating systems and browsers, and prominent websites have announced support. Yet the true extent of adoption across the broader web remains unknown. Measuring this is challenging because websites implement passkeys in heterogeneous ways. Some expose explicit ``Sign in with passkey'' buttons, others hide options under multi-step flows or rely on conditional mediation, and many adopt external mechanisms such as JavaScript libraries or OAuth-based identity providers. There is no standardised discovery endpoint, and dynamic, JavaScript-heavy pages complicate automated detection. This paper makes two contributions. First, we present Fidentikit, a browser-based crawler implementing 43 heuristics across five categories -- UI elements, DOM structures, WebAuthn API calls, network patterns, and library detection developed through iterative refinement over manual examination of 1,500 sites. Second, we apply Fidentikit to the top 100,000 Tranco-ranked domains, producing the first large-scale census of passkey adoption. Our results show adoption strongly correlates with site popularity and often depends on external identity providers rather than native implementations.

Problem

• passkey
• WebAuthn
• FIDO2
• authentication
• adoption

Innovation

• Passkey
• WebAuthn
• FIDO2
• automated detection
• browser crawler