Google's passkey offering is refined and comprehensive enough to recommend, but the ecosystem is incomplete, despite PayPal, Kayak, and others using passkeys
The passkey ecosystem is far from complete, but Google's implementation is now ready to use. — By now, you've likely heard …
Context & Ripple Effects
This review lands at the end of a deliberate ramp: after beta-testing sign-in on Android and Chrome in late 2022, Google enabled passkeys on all accounts across major platforms in May 2023, then began prompting every user to create one by default that October while insisting passwords would remain during the pivot. The verdict here — Google's own implementation is refined enough to recommend — is effectively a quality check on that rollout.
The catch is the other side of the handshake: PayPal, Kayak, and a handful of others accept passkeys, but the ecosystem is far from complete, so most of a user's logins still fall back to the password layer Google is trying to retire.
First-order effects
- Google account holders can now adopt a credential the reviewer deems ready for daily use, but only for the small set of sites — PayPal and Kayak among them — that currently support passkeys.
- Google's stated plan to keep passwords 'part of our lives as we make the pivot' is validated by this review's finding: an incomplete ecosystem forces dual-track authentication for anyone who adopts today.
Second-order effects
- Every major consumer service without passkey support becomes the bottleneck in its users' security posture, giving competitors pressure to add FIDO support or watch early adopters' accounts stay password-bound.
- Apple, which backs passkeys alongside Google, competes on whose preauthenticated-device experience feels seamless first — turning authentication UX into a platform differentiator rather than a commodity.
Third-order effects
- If default prompting plus gradual merchant adoption holds, authentication consolidates around credentials anchored to device platforms held by Google and Apple — a structural shift in who vouches for identity online, with passwords demoted to legacy fallback.
- An incomplete cross-site ecosystem risks entrenching exactly the gatekeepers that host the credentials; whether passkeys end up portable or platform-bound is the open question this review's 'ecosystem is incomplete' caveat points at.
The trend: Authentication is pivoting from passwords to FIDO passkeys, with platform holders — not standards bodies or individual sites — setting the pace of adoption through defaults and device integration.