The Password Is Dying. Here's What's Actually Replacing It

Every tech company wants you to believe 2025 is the year passwords finally die. Apple, Google, Microsoft, Amazon, and PayPal have all built "passkeys" into their login screens, and the pitch is seductive: no more forgotten passwords, no more reused credentials, no more phishing. But passkeys aren't just marketing — they're a genuine cryptographic shift in how authentication works. And the UAE, it turns out, was quietly experimenting with a parallel idea years before the word "passkey" existed.

How a Passkey Actually Works

A password is a shared secret: you type a string of characters, and a server checks it against a stored (hopefully hashed) copy. The problem is structural — that secret has to travel over the internet and sit in a database somewhere, which means it can be phished, leaked, or guessed.

A passkey works differently. When you set one up, your device generates a pair of cryptographic keys: a private key that never leaves your phone or laptop, usually locked behind your fingerprint, face, or PIN, and a public key that gets sent to the website or app you're signing up for. To log in later, the website sends a random challenge, your device signs it with the private key, and the server verifies that signature using the public key it already has on file. Nothing secret ever crosses the network.

This is built on an open standard called FIDO2/WebAuthn, developed by the FIDO Alliance — a consortium that includes Apple, Google, Microsoft, and most major banks and tech platforms. Because the private key never leaves your device and is bound to the specific website it was created for, passkeys are inherently resistant to the two attacks that wreck passwords: there's nothing to steal in a database breach, and there's no credential to type into a fake login page, so classic phishing simply doesn't work on them.

The Numbers Behind the Hype

According to the FIDO Alliance's 2025 Passkey Index, released at its Authenticate 2025 conference, sign-ins using passkeys succeed 93% of the time — more than double the success rate of older methods like passwords-plus-SMS-codes. Companies that have rolled out passkeys at scale, including Amazon, Google, Microsoft, PayPal, Target, and TikTok, reported up to 81% fewer login-related help desk tickets after adoption, according to the same report.

Website support has also grown fast: FIDO Alliance found that 48% of the top 100 websites globally now offer passkey sign-in, more than double the share in 2022. On World Passkey Day in May 2025, FIDO's consumer survey across the US, UK, China, South Korea, and Japan found 74% of people were aware of passkeys and 69% had already enabled one on at least one account.

That said, passkeys aren't a finished product. Recovery is still the weak point — if you lose every device tied to a passkey and haven't set up a backup method, getting back into an account can be harder than resetting a forgotten password. Syncing passkeys across an iPhone and a Windows PC, or between Google and Apple's ecosystems, still involves friction that password managers solved years ago. And critics note that passkeys tie your identity to a platform's cloud (iCloud Keychain, Google Password Manager) in a way a password never did, raising its own lock-in questions.

The UAE Solved a Version of This Problem Years Earlier

Long before "passkey" became a buzzword, the UAE was building its own answer to the password problem — just through a different route. UAE PASS launched in 2018 at GITEX Technology Week, a joint initiative between the Telecommunications and Digital Government Regulatory Authority (then the TRA), the Abu Dhabi government, and what was then Smart Dubai. Instead of asking residents to remember a password for every government portal, UAE PASS ties a single digital identity to a resident's Emirates ID and verifies login with facial recognition on a smartphone. From May 1, 2020, Dubai made it the mandatory method for accessing government services, retiring the old patchwork of agency-specific logins entirely.

The approach has scaled aggressively. According to Gulf News, more than 340 entities — 60 federal bodies, 171 local government departments, and 118 private companies — now offer services through UAE PASS, covering roughly 15,000 individual services. User numbers have climbed from around 4.6 million in 2022 to more than 7 million by 2023, with more recent figures cited in regional trade press putting registered users above 11 million. Beyond login, the app functions as a digital signing tool and document vault, letting residents sign contracts and store official paperwork tied to their verified identity.

It's worth being precise about what UAE PASS is and isn't. It doesn't use the FIDO2/WebAuthn cryptography that defines a passkey in the technical sense — it's a centralized, government-issued identity system built around biometric facial verification rather than device-bound key pairs. But functionally, it was solving the same underlying problem — making a password unnecessary for everyday authentication — well before the passkey standard reached mainstream adoption elsewhere.

Two Models, One Destination

What's interesting is that these represent genuinely different philosophies for a passwordless future. Passkeys are decentralized by design: each website holds its own public key, no central authority links your identity across services, and the standard is meant to work the same way whether you're logging into a bank or a game. UAE PASS is centralized on purpose: one verified national identity unlocks thousands of government and private services, which is efficient for a country running large-scale digital government but would be a much harder sell as a global consumer standard.

Neither model has fully retired the password yet — plenty of UAE PASS-linked apps still keep a password as a fallback, and most passkey-enabled sites let you type one in if your device isn't handy. But the direction is the same everywhere: authentication is moving from "something you remember" to "something you are or something you hold." The UAE just started building its version of that future a few years earlier than most.