When Apple announced iOS 18, the headlines focused on Apple Intelligence, custom emoji, and RCS support. Buried in the developer documentation was a feature that security professionals immediately recognized as transformative: automatic passkey upgrades.
The concept is simple but revolutionary. When you sign into a website or app using a saved password, iOS 18 checks if that service supports passkeys. If it does, iOS automatically creates a passkey for your account and offers to use it instead. One confirmation and you're upgraded, no manual setup required.
How Automatic Upgrades Work
The process happens transparently during normal authentication flows:
- You navigate to a login page for a service where you have a saved password
- iOS autofills your credentials and signs you in
- After successful authentication, iOS detects the service supports passkeys
- iOS creates a passkey for your account in the background
- A subtle prompt appears offering to "Upgrade to Face ID login"
- One tap and the passkey is saved; next time you'll sign in with Face ID directly
The entire interaction adds perhaps three seconds to a login you were doing anyway. There's no separate setup process, no understanding of cryptographic keys required, no decision about which accounts to upgrade. Apple handles everything.
The Psychology of Passive Adoption
Apple's approach reflects deep understanding of user behavior. Previous passkey implementations required users to:
- Understand what passkeys are and why they're better
- Navigate to account settings to find passkey options
- Complete setup processes that felt unfamiliar
- Trust that the new method would work reliably
Each of these steps introduced friction that limited adoption. Most users never sought out passkey setup because their passwords "worked fine."
Automatic upgrades eliminate all of this friction. The upgrade happens in context, during a login the user is already performing. The benefit is immediately obvious: "Face ID instead of typing your password." The trust barrier is low because you've just authenticated successfully.
The Technical Implementation
For developers, automatic passkey upgrades rely on proper passkey implementation with specific metadata:
Passkey-Ready Detection
iOS uses multiple signals to determine if a service supports passkeys:
- The
autocomplete="webauthn"attribute on forms - The
.well-known/webauthnmanifest file - Active passkey challenges during authentication
- App attestation indicating passkey support
Background Credential Creation
After successful password authentication, iOS performs a WebAuthn registration ceremony in the background. The service receives a new passkey credential while the user continues their session. If the background registration fails, no prompt appears and no user action is required.
Credential Manager Integration
New passkeys are stored in iCloud Keychain alongside existing passwords. Safari and apps automatically prefer passkeys when both credentials exist, gradually shifting users away from passwords without explicit migration.
The Numbers Are Staggering
Apple hasn't released specific metrics on automatic upgrades, but industry analysts estimate the feature's impact:
- Upgrade acceptance rate: Over 70% of users accept the upgrade prompt when offered
- Services eligible: Approximately 35% of password-protected services now support passkeys
- Daily upgrades: Estimates suggest millions of password-to-passkey upgrades occur daily across iOS devices
- Return usage: 95% of users who upgrade continue using passkeys rather than reverting to passwords
Combined with Apple's report of over one billion passkey-capable users, automatic upgrades may be adding hundreds of millions of active passkey credentials annually.
Google and Android's Response
Google has implemented similar functionality in Android 14 and later, though with slightly different mechanics. Android's approach:
- Detects passkey support during password autofill
- Offers passkey creation after successful login
- Integrates with Google Password Manager for cross-device sync
- Works in Chrome on desktop with connected Android device
The competitive pressure between Apple and Google has accelerated passkey adoption faster than either company's individual efforts would have achieved.
What This Means for Service Providers
For businesses and developers, automatic passkey upgrades change the adoption calculus significantly:
Passive Adoption Is Real
If you implement passkey support, your users will adopt it without marketing, education, or explicit migration campaigns. Apple and Google do the work for you.
Implementation Quality Matters
Proper implementation (including the autocomplete attributes and well-known manifest) is required for automatic detection. Partial implementations may not trigger upgrades.
Hybrid Support Is Essential
Users will have mixed credentials as upgrades roll out. Your authentication flow must gracefully handle users with passwords, passkeys, or both.
Analytics Need Updates
Track passkey adoption metrics to understand how your user base is transitioning. This data informs decisions about password deprecation timelines.
The Strategic Brilliance
Apple's automatic upgrade approach solves the hardest problem in authentication technology: user behavior change. Previous authentication innovations failed not because the technology was inadequate, but because users didn't adopt them.
By making the upgrade:
- Contextual: It happens during normal authentication, not as a separate task
- Effortless: One tap versus a multi-step setup process
- Beneficial immediately: Face ID is obviously easier than password typing
- Reversible: Users can still use passwords if needed
Apple removed every barrier that had prevented passkey adoption.
Privacy and Security Considerations
Automatic upgrades raise questions about user agency and control:
User Consent
While upgrades require user confirmation, the prompt appears automatically and defaults to upgrading. Users must actively decline to maintain passwords. Privacy advocates have mixed views on this approach.
Credential Control
Passkeys created through automatic upgrades are stored in Apple's iCloud Keychain. Users should understand that their authentication credentials are tied to their Apple ID and can be exported.
Fallback Access
Automatic upgrades don't delete passwords; they add passkeys alongside them. Users retain password access until they explicitly choose to remove it. This provides safety net during the transition.
Recommendations for Implementation
To take advantage of automatic passkey upgrades:
- Implement passkeys properly: Follow WebAuthn specifications and include required metadata
- Add discovery metadata: Include autocomplete attributes and well-known manifest
- Test upgrade flows: Verify that iOS and Android properly detect your passkey support
- Support hybrid authentication: Allow both passkeys and passwords during transition
- Monitor adoption: Track passkey usage to understand your user base's transition
The Future: Password Optional, Then Password-Free
Automatic passkey upgrades represent a transition strategy, not an end state. The progression is clear:
- Today: Passwords and passkeys coexist; automatic upgrades gradually shift users
- Near future: Passkeys become primary; passwords become fallback for edge cases
- Eventually: Services begin removing password support entirely for passkey-only authentication
Automatic upgrades accelerate this timeline by ensuring passive adoption reaches critical mass faster than education campaigns ever could.
Conclusion
iOS 18's automatic passkey upgrade feature is Apple at its best: solving a hard problem by removing friction rather than adding features. The approach recognizes that users don't care about authentication technology; they care about getting things done with minimum hassle.
By meeting users where they are (logging in with passwords) and seamlessly transitioning them to where they should be (authenticating with passkeys), Apple is making the password obsolete without requiring anyone to understand why.
For businesses and developers, the message is clear: implement passkey support now, implement it properly, and let Apple and Google handle the adoption challenge. The automatic upgrade machinery is running, and every day it's converting more of your users from vulnerable password authentication to secure passkey authentication.
The password isn't being killed by a competitor; it's being peacefully retired by automation.