New Site Shames Instagram, Netflix for Skipping Passkeys

Imagine never getting hacked because you never have to remember another password again. That future is here, but some of your favorite apps are refusing to let you use it.

Security researcher Scott Helme just launched whynopasskeys.com, a website that publicly lists major companies still refusing to offer passkeys to their users. The list includes Instagram, Netflix, and Spotify, along with one in four other major apps and services.

Passkeys represent a breakthrough in online security that experts now consider the gold standard for protecting accounts. Instead of typing passwords that hackers can steal or trick you into revealing, passkeys are unique digital credentials generated by your device and tied specifically to your phone or computer.

They work with the biometric security you already use, like Face ID or Touch ID. Your device does all the work automatically, storing the passkey safely in your password manager without you memorizing anything.

The beauty of passkeys is that hackers can't phish them through fake emails or steal them in data breaches. Unless someone physically steals your phone or computer, your accounts stay locked tight.

Apple, Google, and Microsoft have already joined the good side, offering passkeys across their platforms. Facebook and WhatsApp offer them too, which makes Instagram's absence even more puzzling since all three belong to Meta.

Instagram technically allows passkeys, but only if users first link their account to Facebook and enable passkeys there. For the millions who prefer keeping their accounts separate, real passkey protection remains out of reach.

The Ripple Effect

Helme's motivation is simple but powerful: public pressure works. "A list is a surprisingly effective motivator," he wrote. "Nobody wants to be on the list."

As more people learn about passkeys and demand better security, companies face a choice between protecting their users or explaining why they won't. The website turns that conversation into something visible and shareable, giving users a tool to push for change.

When tech giants compete to stay off the shame list, everyone wins with stronger security that's actually easier to use.

The future of online security doesn't require remembering complex passwords or constantly resetting forgotten ones—it just requires companies caring enough to flip the switch.