This website publicly shames popular sites like Instagram, Netflix, and Spotify for being too lazy to add passkeys

A new website is doing something many frustrated security experts have wanted for years. It is publicly naming big companies that still refuse to support passkeys. Called Why No Passkeys, the site tracks major platforms that continue to rely on old-school passwords even as passkeys become the safer option. If you use apps like Instagram, Netflix, or Spotify, you might be surprised to see them on the list.

The website was created by security researcher Scott Helme, who previously teamed up with Troy Hunt in 2017 to launch WhyNoHTTPS, a site that helped push much of the internet toward encrypted browsing.

A surprising number of tech giants are stuck in the past

Passkeys are designed to replace passwords with device-based logins like Face ID or fingerprint scans. They are harder to steal, phishing-resistant, and far easier to use. Big names like Google, Apple, and Amazon have already embraced them, but many popular consumer platforms have not.

7 of the top 25 most visited sites globally still lack native passkey support, including Instagram, Netflix, Spotify, Samsung, Roblox, and Baidu. These are not small businesses without engineering resources; they are platforms with hundreds of millions, sometimes billions, of users still protected by nothing more than a password.

Interestingly, Meta already offers passkeys on Facebook and WhatsApp, yet Instagram users can only access the feature if they link their account to a Facebook login with passkeys enabled (via TechCrunch).

Why it matters?

The site works like a public leaderboard, separating companies that support passkeys from those that do not. Their goal is to create public pressure and make it harder for companies to ignore better security.

This matters because passwords remain one of the weakest links online. Data breaches, reused logins, and phishing scams still hit users every day, and passkeys eliminate many of those risks. For you, it’s a reminder that even the apps you trust most may still be behind on security. And now, there is a website making sure everyone knows it.