X (Previously Known as Twitter) introduces Passkeys

1. Why does X introduce Passkeys?#

Post its acquisition by Elon Musk, Twitter underwent significant transformation, including a rebranding to "X." Also, the controversial decision to withdraw 2FA via SMS, a move speculated to be a cost-saving measure, took place recently. However, the decision was met with considerable backlash, with concerns about diminished security and the potential for increased account breaches.

Passkeys present a solution to these challenges. They eliminate the substantial transactioal costs associated with SMS-based authentication. Moreover, they offer a more user-centric approach.

Additionally, considering the majority of X's user base predominantly interacts through mobile platforms such as iOS and Android, these devices emerge as the perfect candidates for the initial phase of a comprehensive passkeys rollout. Recent trends, like PayPal's strategy of primarily offering passkeys to mobile users, underline this thought process. Implementing passkeys can also vastly improve the cross-device experience, particularly when integrated with synchronized passkeys from cloud accounts like Google Password Manager, Apple iCloud Keychain, and contemporary password managers like 1Password and Dashlane.

Now, in late January 2024, X has started to roll out passkeys for US customers for iPhones and iPads. It's unclear when more regions or platforms like Android will gain support. Moreover, some users figured out that the entire US user base has already access to passkey indicating a staged rollout even within the US iOS and iPadOS user base.

X encourages users to use passkeys as the primary login method due to seamless login experience and the advanced security that they bring. However, it's not mandatory to use a passkey (yet). The passkeys FAQ page provides more details and will be kept up-to-date by X.

2. Passkeys on X: What's Next?#

Though there's no official announcement regarding the further rollout of Xs passkey feature, the platform is expected to roll out passkeys to Android users and other global regions soon. The rapid adoption of passkeys by other tech behemoths, such as GitHub, Google, OnlyFans and TikTok, only strengthens this prediction.

3. How Corbado can help#

A staged rollout like X's produces two populations at the same moment. Some users can reach a passkey, most cannot yet, and both are logging in this week. That makes the honest question about the rollout a comparison between groups rather than a before-and-after reading of one line on a chart. Corbado Observe, the authentication observability layer, is built around that comparison.

See Method Uplift in Corbado Observe →

• Compare who could reach what. Method Uplift sorts engaged login flows by which methods were actually available in them (password alone, password with passkey, password with social, all three) and reads every bundle against the password-only baseline. During a phased rollout those bundles already exist side by side, so you get the uplift without waiting for a clean cut-over date.
• See where the staging landed. The quadrant view plots success rate against the combined error and abort rate, and groups the bubbles by operating system, browser, market or touchpoint alongside the bundle. An iOS-first US phase shows up as its own cluster next to the users who were never offered the option, which is what tells you whether the phase is going well or merely going.
• Know when the number is too small to trust. Any group under 300 engaged flows has its success rate and its comparison against the baseline suppressed, because the confidence interval at that volume is wider than the difference you would be reading. Early in a staged rollout that guard matters more than the number itself.

Section 1 frames X's move partly as a cost decision about SMS. Whether it pays back is the same comparison: what the users who can reach a passkey do, measured against the users who still cannot.

About Corbado

Corbado is the Passkey Intelligence Platform for large-scale CIAM teams running consumer authentication. We help you see what IDP logs and generic analytics tools can't: where passkeys, passwords, OTP, social login and fallback journeys succeed, stall or fail, which devices and browsers create friction, and when an OS update silently breaks login. Two products: Corbado Observe layers process mining and observability across authentication journeys. Corbado Connect adds managed passkeys with analytics built in alongside your IDP. VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →

Frequently Asked Questions#

Why did X introduce passkeys instead of restoring SMS two-factor authentication?#

X removed SMS 2FA as a cost-saving measure after Elon Musk's acquisition, drawing significant backlash over reduced account security. Passkeys address both concerns simultaneously: they eliminate the transactional costs of SMS-based authentication while delivering stronger, more user-friendly security than SMS codes.

Which platforms and regions currently support passkeys on X?#

As of late January 2024, X supports passkeys for US customers on iPhones and iPads, with a staged rollout even within that group meaning not all US iOS users received access at the same time. Expansion to Android users and other global regions is anticipated but has not been officially announced by X.

Do I have to switch to a passkey on X or is it still optional?#

Using a passkey on X is currently optional. X encourages passkeys as the preferred login method due to their seamless experience and advanced security, and maintains a dedicated passkeys FAQ page that is kept up to date with the latest guidance.