Passkeys have increasingly become the preferred method for protecting online accounts from hackers, with cybersecurity experts widely viewing them as one of the safest alternatives to traditional passwords.
Despite this, nearly one-quarter of major online apps and services still do not offer users the option to sign in with passkeys. Among the notable platforms that currently lack full passkey support are Instagram, Netflix, and Spotify. Those figures come from a newly launched website designed to highlight companies that have yet to publicly embrace the technology.
Unlike conventional passwords, passkeys are created directly on a user’s device and are cryptographically linked to both that device and the specific website or application where they are used. Authentication can rely on biometric methods such as Face ID or Touch ID, or even a physical security key. Passkeys can also be securely stored within password managers, making the login process both easier and more secure.
One of the biggest advantages of passkeys is that users are no longer required to remember complex passwords. Since passkeys cannot be easily stolen through phishing or traditional credential theft, they provide a much stronger layer of protection unless an attacker gains physical access to the user’s trusted device.
The website, whynopasskeys.com, was created by longtime security researcher Scott Helme. In a blog post explaining the project’s purpose, Helme said the goal is to encourage more organisations to introduce passkey support and make the technology available to their customers.
“A list is a surprisingly effective motivator. Nobody wants to be on the list,” Helme wrote.
Several of the world’s largest technology companies, including Apple, Google, and Microsoft, already appear on the website’s positive side because they offer passkey authentication options to their users.
There is, however, one important exception worth noting. Although Instagram itself does not currently offer standalone passkey support, users can enable passkey authentication if their Instagram account is linked to a Facebook account with passkeys enabled.
