Passkeys are increasingly being promoted as one of the most effective ways to protect online accounts. By reducing reliance on passwords, they help prevent phishing attacks, simplify sign-ins and strengthen account security. Despite those advantages, however, many major digital platforms have yet to adopt the technology.

A Security Upgrade Still Missing At Scale

That gap is the focus of whynopasskeys.com, a new site created by security researcher Scott Helme to highlight companies that have not yet enabled passkeys for their users. The site tracks major consumer brands that continue to rely on older login methods even as passkeys become the industry standard.

Follow THE FUTURE on LinkedIn, Facebook, Instagram, X and Telegram

Among the services still without passkey support are Instagram, Netflix and Spotify, according to the site’s data.

Why Passkeys Matter

Unlike traditional passwords, passkeys are generated on a user’s device and linked both to that device and to a specific website or application. Authentication can be completed through biometrics such as Face ID or Touch ID, a hardware security key or a password manager.

Because users do not need to create or remember passwords, opportunities for credential theft, phishing attacks and password reuse are significantly reduced. In most cases, gaining access to an account would require direct access to the user’s device.

Public Accountability As A Pressure Tactic

In a blog post explaining the project, Helme said the goal is to create pressure by making the absence of passkey support visible. “A list is a surprisingly effective motivator. Nobody wants to be on the list,” he wrote.

That approach has already worked elsewhere in cybersecurity: when businesses are publicly compared against peers on basic protections, they often move faster to close the gap. In this case, the list is intended to push platforms to give users a stronger and simpler login option.

The Companies Moving Faster

Many large technology companies have already adopted passkeys, including Apple, Google and Microsoft, reflecting the technology’s growing role in account security.

Implementation, however, remains uneven. Instagram users can currently access passkeys only when their account is linked to a Facebook account that already has passkey support enabled, highlighting differences in adoption even within the same company.

The Bigger Business Question

Meta has not publicly explained why passkeys are available on some of its platforms, including Facebook and WhatsApp, but not fully across Instagram.

Debate within the industry is no longer centred on whether passkeys work, but on how quickly companies are willing to deploy them. As phishing, credential theft and account fraud remain persistent cybersecurity challenges, passkeys are increasingly being viewed not as an optional feature but as an emerging security standard.