Apple, Google and Microsoft made passkeys sync across devices — and platforms

By 2022 the password was the internet's best-documented security hole: weak and easily guessed credentials factored into more than 80% of data breaches, per Verizon's annual breach report cited by TechCrunch. The FIDO Alliance and the W3C had a technical answer since 2018 — WebAuthn, which signs each site with a key pair generated on the user's device, so servers hold no secret worth stealing and phished pages get nothing. Yet passwordless sign-in remained a niche for enterprise security keys.

The blocker was logistics, not cryptography. A FIDO credential lived on one device and had to be re-enrolled website by website on every new phone or laptop, so a normal person with three devices would never bother. On World Password Day, 5 May 2022, Apple, Google and Microsoft jointly committed to fix exactly that within a year: passkeys would sync across a user's devices, a phone could sign in to apps on a nearby computer, and the whole thing would work across macOS/Safari, Android/Chrome and Windows/Edge — an iPhone passkey logging into Chrome on a Windows PC.

Two months later, at WWDC, Apple shipped passkeys into iOS 16 and macOS Ventura betas and even gave the feature an icon. And in August 2022 Microsoft's identity VP Alex Simons confirmed the third piece: all three companies would use the common noun 'passkey' — not 'FIDO authentication' — so ordinary users would meet one name no matter whose device they held. Nobody claimed the word as a brand.

Why this worked: the three rivals do not own the FIDO standard, but they own its distribution — operating systems, browsers and the credential clouds already on billions of devices. A simultaneous cross-platform commitment turned a protocol that had stalled for four years into a feature people would actually be handed. CISA director Jen Easterly publicly endorsed the move as raising the cybersecurity baseline.

Sync the credential like a password — keep it phishing-proof

The old FIDO deployment model required per-device, per-site re-enrollment, which no multi-device consumer would ever do; cloud sync cut that cost to zero while keeping the phishing resistance.

All three platform vendors committed at once, so no user faced a proprietary passwordless silo — the silo problem is what killed earlier single-vendor schemes.

Agreeing on 'passkey' as a plain common noun gave the standard a single consumer-facing name; the last mile of a technical standard is vocabulary.

Using the phone as a roaming authenticator meant older laptops could adopt without buying hardware security keys.

When a standard stalls, read the enrollment flow, not the spec. The 2018 protocol was finished; what mattered in 2022 was sync, one joint launch, and a plain name. Distribution was the moat.

Apple demonstrated passkeys at WWDC 2022 and shipped them in iOS 16 and macOS Ventura betas that summer; Google said Android developer tooling would open 'towards the end of 2022'; Microsoft committed to Microsoft-account sign-in via phone passkeys 'in the near future'. By August 2022 the three had also converged on the 'passkey' name, and CISA's director called the joint pledge a milestone for raising America's security baseline.