Passkeys have been around for years. why is adoption still so slow?

Passkeys are objectively better than passwords.

Phishing-resistant, nothing to forget, nothing to breach, no password database to leak. the case for them is pretty airtight. and yet most products still default to email and password. most users have never set up a passkey. most developers have never shipped one.

so what's actually going on?

i think it's a few things.

passkeys require device support and most teams don't want to debug the fallback experience across every browser, OS, and device combination.

the setup flow feels unfamiliar to users who've been typing passwords for twenty years. and there's no forcing function, unlike passwords which visibly fail, passkeys just quietly don't get adopted.

the irony is that the friction is mostly on the builder side, not the user side. once a passkey is set up, the experience is genuinely better. face ID or fingerprint, done. no form, no reset email, no support ticket.

curious where people are on this. are you shipping passkeys yet? and if not, what's actually blocking you?