Microsoft asks millions of Windows and Xbox users to DELETE their passwords in dramatic shake-up

In a blog post discussing its ambitions to move towards passkeys published last year, Sangeeta Ranjit, Microsoft Group Product Manager and Scott Bingham, Microsoft Principal Product Manager wrote: "There’s no doubt about it: The password era is ending. Bad actors know it, which is why they’re desperately accelerating password-related attacks while they still can.

"At Microsoft, we block 7,000 attacks on passwords per second — almost double from a year ago. At the same time, we’ve seen adversary-in-the-middle phishing attacks increase by 146% year over year. Fortunately, we’ve never had a better solution to these pervasive attacks: passkeys.

• Warning to 40.8 million Brits putting themselves at risk with dangerous password habit

"Passkeys not only offer an improved user experience by letting you sign in faster with your face, fingerprint, or PIN, but they also aren’t susceptible to the same kinds of attacks as passwords. Plus, passkeys eliminate forgotten passwords and one-time codes and reduce support calls."

While Microsoft has flipped the switch to promote passkey for new users creating an account to use on Windows PCs, Xbox, or Office 365 applications... existing users shouldn't feel left out. If you use any of these services, you can visit your account settings to delete your password and switch to a passkey now.

What Are Passkeys?

Biometric methods like Face ID, ultrasonic fingerprint scanners, and Windows Hello offer stronger security than passwords by using unique physical traits that are nearly impossible to replicate.

For example, Face ID — the facial recognition that secures all current iPhone models — has a 1 in 1,000,000 chance of a false match, while fingerprints have odds around 1 in 50,000. In contrast, passwords are vulnerable to guessing, reuse, and phishing.

That’s why Passkeys — built on biometrics and public-key cryptography — are emerging as the safer, password-free future. They're phishing-resistant, device-bound, and frictionless to use, offering a smarter way to lock down your digital life without relying on your memory.

So, how do they actually work? Passkeys use a pair of cryptographic keys: a private key stored securely on your device and a public key saved by the service you’re logging into.

When you try to sign in, the service sends a challenge to your device. After a successful check of your face, fingerprint, or PIN on the smartphone, tablet, or computer that you're using — the private key will signs it locally, and the signed response is verified using the public key — no secrets ever leave your device.

Unlike passwords, which are sent to and stored on servers (where they can be stolen), Passkeys never transmit sensitive information. Not only that, but the FIDO Alliance, which promotes passkeys, notes they're both more convenient and more secure than traditional passwords.

How Microsoft Is Ditching Passwords

The shift to passwordless accounts is happening right now, with Microsoft rolling out the new sign-up process throughout May. When you create a new Microsoft account, you'll be asked for your email address and will receive a verification code.

After entering this code, you'll be prompted to add a passkey using your face, fingerprint, or PIN—with no password required. Microsoft has also updated its sign-in screens with a "streamlined" user experience that prioritizes passwordless methods.

"This simplified experience gets you signed in faster and, in our experiments, has reduced password use by over 20%," Microsoft explained. If you choose to skip passkey setup initially, you can return to it later through your account settings.

The company hasn't specified an exact date when all new accounts will be passwordless, but the change is expected to be fully implemented within a matter of days.

According to data collected by Microsoft, passkeys significantly outperform traditional passwords in both security and user experience.

According to the company, 98% of passkey login attempts are successful, compared to just 32% for password-based accounts — since people often forget their password or type in the wrong character.

Passkey logins are also speedier — taking only 8 seconds on average, compared to 69 seconds for traditional password and two-factor authentication combinations.

Microsoft says that account owners prefer passkeys over passwords. In the company blog post, it confirms: "Our initial launch of this new design saw a 10% drop in password use and a 987% increase in passkey use."

Delete Your Passwords

Microsoft's ultimate goal is to eliminate passwords from its platform entirely. It spells out why it's pushing ahead with this goal in the blog post: "While enrolling passkeys is an important step, it’s just the beginning.

"Even if we get our more than one billion users to enroll and use passkeys, if a user has both a passkey and a password, and both grant access to an account, the account is still at risk for phishing. Our ultimate goal is to remove passwords completely and have accounts that only support phishing-resistant credentials.

"In 2022, we made it possible for users to completely remove their password and sign in with alternative methods. Since then, millions of users have deleted their passwords and protected themselves against password-based attacks.

"Now with passkeys, we can truly replace passwords with something faster, safer, and easier to use. It’s an ambitious vision, but we firmly believe in a phishing-resistant future for all scenarios, including account recovery and bootstrapping."

This strategy builds on Microsoft's decade-long journey toward passwordless authentication, which began with Windows Hello in 2015. One decade later, Microsoft says more than 99% of people who sign into their Windows devices with their Microsoft account already do so using Windows Hello.

The company is now seeing nearly a million passkeys registered every day — showing strong momentum toward its passwordless vision.

Microsoft isn't alone in pushing for a passwordless future. Apple introduced passkeys as part of iOS 16 back in 2022, followed by Google's Android operating system, which now allows you to sign in to various accounts via a biometric check — like a under-screen fingerprint scan, facial recognition check, and more.

The FIDO Alliance has launched a "Passkey Pledge" to accelerate the global movement away from passwords, with Microsoft and dozens of other organisations participating. Popular services like Amazon and PayPal already support passkey authentication through Google's implementation.

WhatsApp implemented passkey support last year, so billions of its users across iPhone and Android can secure their conversations with a biometric check on their smartphone. It follows a similar move by Elon Musk on X, formerly Twitter.

Research shows about 75% of users in the United States are now aware of passkey, but only 42% have decided to use one to set up an account. Just 23% have gone passwordless across all their compatible accounts.

As of December 2024, over 15 billion user accounts globally can sign in using passkeys instead of passwords.