Visa and IDFC FIRST Bank push passkeys via Visa's payment passkey product.
Guess there will be more and more banks offering that, however, adoption pace is still pretty slow. From UX point of view, it just makes a lot of sense though.
Great news for Singaporeans. Gives basically phishing-resistant logins to more than 5m people
and I expect that to furhter push the private sector to launch passkeys.
Read more here: https://mothership.sg/2026/06/singpass-launch-passkey-login/
Found this new website https://whynopasskeys.com/ that provides and shames a list of the high-traffic sites of different countries that don't offer passkeys to protect their users.
What I found interesting is that globally only 6 out of 25 are missing but when you go on country level it's usually that +20 out of 25 are missing, so still much work to do.
They're even going one step further apparently. Starting July 31, it will be mandatory to use passkeys for logins.
Apparently, you need to re-register passkeys at Notion if you've already created some with rpID "notion.so".
What I find interesting: Notion already publishes Related origin requests (ROR): for notion.so and it includes notion.com: https://www.notion.so/.well-known/webauthn
{
"origins": [
"notion://www.notion.so",
"https://www.notion.so",
"https://mail.notion.so",
"https://notion.com",
"notion://notion.com",
"https://app.notion.com",
"notion://app.notion.com"
]
}
if Notion kept "notion.so" as the common rpID, then notion.com could still authenticate existing notion.so passkeys via ROR, at least in clients that support it.
So if re-registration is now required, my guess is that Notion wants "notion.com" to become the new canonical rpID. In that case, ROR does not migrate existing credentials. A passkey created for "notion.so" is still scoped to "notion.so" and cannot be used as a "notion.com" credential.
Android Authority discovered the possibility to export passkeys from Google Password Manager on Android.
This will allow you to securely export and import your passkeys to other credential managers like 1Password or Dashlane.
Great for the wider ecosystem and interoperability.
Read the full article here: https://www.androidauthority.com/google-passkeys-move-to-another-password-manager-android-3666965/
Great news for the developer ecosystem that you can now build your WebAuthn server directly in Laravel: https://laravel-news.com/laravel-introduces-first-party-passkey-authentication-support
For this year's world passkey day (sometimes called world password day - not sure if it's now officialy passkey day), we put toegther a passkey benchmark to understand where the adoption of passkeys in consumer apps/websites really stands.
Some things that I found quite interesting
- mobile passkey readiness is at 97-99%
- passkey enrollment rates can reach up to 83% with the right nuding
I think it's obvious that passkeys are gaining a lot of traction. Some deployments are better than others and there's many ways how you can optimize an existing implementation (this will take time until best practices really are universally implemented).
See the full benchmark here if useful: https://www.corbado.com/passkey-benchmark-2026
Curious whether this matches what others are seeing in their deployments?
In a recent update Meta introduced they're launching passkeys for Instagram via the improved Meta account.
In general the statement (see below) is quite strategic IMO. For a decade, Meta has been quietly behind Apple and Google on credential infrastructure. While Apple unified iCloud Keychain and Google built One Account, Meta let Facebook, Instagram, WhatsApp and Quest each maintain separate authentication universes. Slowly they were merged in parts through Accounts Center (Whatsapp is still kind of kept separate). but with the new Meta Account, there's now a unified login for:
- Facebook
- Instagram
- Messenger
- Threads
- Meta AI
- Meta Quest
- Ray-Ban / Oakley AI glasses
Meta needed an identity layer to compete in AI + AR
Meta bets that the next decade of consumer tech is glasses, agents and credentials shared across devices. Apple has Apple ID. Google has One Account. Meta couldn't ship Meta AI needs something comparable to really make use of its 3 billion user accounts.
Passkeys are pushed on all apps
Instagram getting passkeys aligns the path they had started with Whatsapp, Facebook and Messenger. Every Meta surface needs to support the same login primitive or the "one account" promise breaks.
Payments are the next domino (?)
Meta has tried to ship a payments solution multiple times. Without account unification it never worked. With Meta Account as the rail, every Meta property can now make use of a passkey (most users will use their biometrics, that's the missing piece for payment UX). This way they could introduce a PayPal / Amazon Pay / Google Pay / Apple Pay competitive solution.
Read more: https://about.fb.com/news/2026/04/meta-account/
What do you think about this update?
Next superannuation fund in Australia offers phishing-resistant auth to their members.
List continues to grow (after last year's massive credential stuffing attacks in the industry): https://www.corbado.com/faq/superannuation-funds-passkeys