The replacement for passwords exists, works well, and is supported by every major platform and browser. Adoption remains a fraction of what the support level would suggest, and the reasons are instructive.
What a passkey is
A cryptographic key pair. The private half stays on your device, protected by whatever unlocks the device. The public half goes to the website. Signing in means your device proves it holds the private key.
Nothing secret is transmitted, so there is nothing for a server breach to leak and nothing for a phishing site to capture. That eliminates the two failure modes responsible for most account compromise.
Why it is genuinely better
Phishing stops working. A passkey is bound to the specific site it was created for, and a convincing replica at a similar domain cannot invoke it. The user does not have to notice anything.
Credential stuffing also stops working, because there are no reusable credentials to stuff.
What is slowing it down
The mental model. Passwords are portable in a way people understand – you know it, you can type it anywhere, you can write it down. Passkeys live on devices and sync through platform accounts, and explaining that to a non-technical user is genuinely hard.
The recovery question makes it worse. What happens when the phone is lost is the first thing people ask, and the answer involves platform account recovery, which is a longer conversation than anyone wants at a sign-up screen.
The lock-in concern
Passkeys syncing through a platform account tie your credentials to that ecosystem. Cross-platform export standards exist but are unevenly implemented. That is a legitimate reservation and it is being addressed slowly.
The practical advice
Enable passkeys on the accounts that matter most – email first, since it is the recovery path for everything else. Keep a password and second factor as a fallback while support is uneven. The transition will take years, and running both is fine during it.