Passkey Maturity Tiers.
Passkey maturity tiers (Bronze, Silver, Gold, Platinum) grade a passkey implementation against a 16-check rubric developed by the FIDO UX Working Group, from a required baseline up to optional hardening.
Passkey support is not a yes or no. Two products can both "support passkeys" while one buries them three menus deep and the other offers them at the right moment and upgrades users automatically. The tiers give teams a shared way to say where they are. The source is the Authenticate 2026 Day 1 recap on FIDO's conference site, which summarises the panel; FIDO's own description of the forthcoming FIDO Passkey Rubric calls it a practical checklist that brings together its research, UX guidance and expert knowledge.
Enrollment moment. The same day, Spotify's Laura de Bella and Quendoline Jansen described designing enrollment for the best moment, which their research puts at about 10 seconds after login, or during account recovery. That fits the Silver and Gold checks: smart prompting decides when to ask, and automatic upgrades remove the ask entirely where the platform allows it.
Our reading. The tiers map onto the adoption metrics. Bronze and Silver checks mostly move enrollment. Gold checks (automatic upgrades, keeping credential lists in sync through the Signal API, recovery that does not fall back to a weak factor) are what close the gap between enrollment and sign-in share. Recovery deserves special attention, because a passkey account that recovers through SMS is only as strong as SMS; see account recovery design and the passkey fallback capability matrix.
Common questions
What are the passkey maturity tiers?
Bronze, Silver, Gold and Platinum, from a 16-check rubric developed by the FIDO UX Working Group and presented at Authenticate 2026. Bronze is the required floor, Silver the launch target, Gold adds automatic upgrades, Signal API syncing and risk-matched recovery, and Platinum covers account hardening and related origins.
What does a Bronze passkey implementation need?
Per the Authenticate 2026 recap: a place in account settings to manage passkeys, a visible fallback sign-in option, support for more than one passkey per account, and one consistent name and icon for passkeys across the product.
When is the best moment to ask a user to create a passkey?
Spotify's team said at Authenticate 2026 that its research puts the best enrollment moment at about 10 seconds after login, or better still during an account recovery flow. Spotify also framed passkeys as a year-long plan rather than a single launch.
Is the rubric an official FIDO specification?
It is a UX checklist, not a protocol specification. FIDO has said a FIDO Passkey Rubric will be available on Passkey Central. Until it is published, the tier contents come from the conference recap, so check the published rubric for the exact 16 checks.
Related terms
In the guides
Account Recovery Design: The Most-Attacked Flow in CIAM
The recovery flow is the security floor of the entire auth system. Email magic link on a passkey-secured account is, structurally, an email-secured account. Design recovery deliberately.
Passkey and Fallback Capability Matrix: Web, Native Apps, Managed Recovery
Which CIAM vendors document passkeys on web and in native iOS and Android apps, what fallback ships in the product, and who actually sends the message. Checked 18 September 2026.
Passkeys Explained: How Synced Credentials Replace Passwords
Passkeys are the user-facing brand for synced WebAuthn credentials. A practical explanation of how they work, sync, recovery, and the deployment patterns that make adoption real.
WebAuthn Level 3: What CIAM Teams Should Ship
WebAuthn Level 3 was proposed as a W3C Recommendation on 20 July 2026. PRF, related origins, Signal API, and conditional create change the CIAM passkey checklist.