New site tracks apps failing to adopt passkeys

A new website, whynopasskeys.com, has launched to track the adoption of modern authentication standards across the internet. The platform names and shames companies that still do not offer passkeys to their users. According to the website, one in four major apps and services on the internet do not offer passkeys, leaving a significant portion of digital platforms reliant on older, less secure security methods. Among the major services listed on the site as lacking this option are popular consumer platforms such as Instagram, Netflix, and Spotify.

Passkeys are more secure than passwords because they are generated by a user’s device and tied to that specific phone or computer and the website they are created for. This authentication method can rely on biometrics such as Face ID, Touch ID, or a physical security key, and the credentials can be stored automatically in a user’s password manager. The crucial advantage of this system is that the user does not have to remember a password, making the accounts much harder for a hacker to steal or phish unless they gain physical control of the target’s devices. While major technology companies such as Apple, Google, and Microsoft have already adopted the standard and offer passkeys to their users, many other large-scale services have yet to implement them.

The website is the project of Scott Helme, a longtime security researcher who created whynopasskeys.com to push companies to enable the feature and give users the chance to adopt it. In a blog post, Helme explained the motivation behind the site, noting that public pressure can drive corporate action. “A list is a surprisingly effective motivator. Nobody wants to be on the list,” wrote Helme. The site also highlights technical inconsistencies among platforms; for instance, users can turn on passkeys on Instagram, but only if their account is tied to a Facebook account with a passkey enabled. Meta did not immediately respond to requests for comment on why some of its products offer passkeys while Instagram does not. TechCrunch also reached out to Netflix and Spotify for comment.

Why it matters

The project uses public pressure to accelerate the industry-wide shift toward passkeys, highlighting that a significant portion of major internet services still rely on outdated authentication methods.