What the comparison claims
The shattered.io piece says Steam has not added passkey support as of October 20, 2026. It adds that Xbox and Microsoft Account default hundreds of millions of sign-ins to passkeys, while PlayStation Network rolled out passkeys and then went quiet about them. Its conclusion is that only Microsoft and Nintendo have officially documented passkey support.
The conclusion has two problems. PlayStation documents passkeys prominently. And several Microsoft statistics in the piece (95% sign-in success, roughly 14 times faster, "hundreds of millions" defaulted) could not be matched to a first-party Microsoft page in our review. Treat those figures as unverified for now.
Steam: Steam Guard is not a passkey
Steam's support documentation describes Steam Guard as an extra layer on top of an account name and password. On an unrecognized device you get a code by email or from the Steam Mobile app. The mobile authenticator is Steam's own recommendation for the strongest protection.
The Steam Mobile app can also sign you in by scanning a QR code. That is a Steam-specific approval flow, not a FIDO passkey. Users on Steam's forums describe it this way: scanning a QR code and approving in the app counts as a passwordless sign-in.
Steam's reviewed help pages describe password plus Steam Guard and do not document passkeys. They also don't contain an explicit statement that passkeys are absent. So the careful wording is that Steam's public documentation doesn't list a passkey option. Community threads show users still asking for one. One poster wrote that Steam Guard could stay as a requirement while security keys and passkeys are added on top.
Steam's own advice is practical:
- Use the mobile authenticator.
- Keep your email account secure, because control of the registered email can enable a Steam password reset.
- Use different passwords for Steam and for email.
- Avoid phishing and malware, and never share Steam Guard files.
- If you suspect compromise, use Sign out everywhere, change your password, and deauthorize untrusted devices.
Microsoft account and Xbox: passkeys, with caveats
Xbox sign-in runs through a Microsoft account, and Microsoft documents passkeys for personal and work or school accounts. A passkey can live on your device, in a synced credential manager such as Microsoft Password Manager, on a phone or tablet, or on a physical security key. Windows Hello can also hold one. Each time you sign in, the device asks for its usual unlock, such as face, fingerprint or PIN.
To add one to a personal account:
- Sign in to the Advanced Security Options page for your Microsoft account.
- Choose Add a new way to sign in or verify.
- Select Face, Fingerprint, PIN or Security Key.
- Follow the device prompts and choose where to save the passkey.
Work or school accounts only get this if the organization supports it, and IT may restrict the options. Admins should check policy before telling users to enroll.
A passkey is not the same as removing your password. Microsoft treats the Passwordless account setting as a separate step. After you turn it on, sign-in relies on methods such as the Authenticator app, Outlook for Android, Windows Hello, security keys or SMS codes. SMS is on that list, which matters if your goal is to get rid of SIM-swap exposure.
Compatibility matters too. Some older software still needs a password, and Microsoft names these cases:
- Xbox 360
- Office 2010 and earlier
- IMAP and POP email
- Some Windows features, such as Remote Desktop and Credential Manager
Xbox One and Xbox Series X|S can sign in without a password by using another device and entering the code shown on the console.
One more Microsoft warning applies here. If you remove all security information from the account, it goes into a restricted state for 30 days. Add and test new methods before you delete old ones.
Nintendo: real passkeys, but the password stays
Nintendo's support page confirms that a passkey can replace the password when you sign in or re-authenticate. Biometric data stays on your device and isn't sent to Nintendo. Setup is under Account Settings, then Sign-in and security settings, then Passkey.
Nintendo's own limits are worth knowing:
- Your email and password keep working. If you use them after registering a passkey, you must also enter an emailed verification code. If 2-Step Verification is on, you can use that code instead.
- Nintendo says not to register a passkey on a shared device, family devices included.
- Apple devices need iCloud Keychain, and Android needs a screen lock.
- You can't create a passkey on a Switch or Switch 2. You sign in on the console by scanning a QR code with a phone that holds one.
- If you lose or change the phone, you may need your email and password again.
This contradicts the shattered.io suggestion that a Nintendo passkey removes password dependence. It adds a stronger option next to the old one.
PlayStation: the "unclear status" claim doesn't hold up
Sony Interactive Entertainment announced the global release of passkeys on February 26, 2024. PlayStation's current US support page gives full setup steps:
- Sign in to Account Management.
- Go to Security and enable Sign in with Passkey.
- Select Create a Passkey and follow the prompts.
On a PS5, the path is Settings > Users & Accounts > Account > Security > Sign in with Passkey. The page also covers adding more passkeys, removing them, and reverting to a password.
Sony lists these requirements and known problems:
- Passkeys work on most phones running iOS 16 or later, or Android 9 or later. Browser sign-in should use current Safari, Chrome or Edge.
- Some hardware security keys may have issues.
- Remote Play on Mac may need a password.
- Some Android and Windows combinations can cause trouble.
- PS3 and PS Vita still need a password.
Other shattered.io pieces already disagree with this one. A companion guide says PlayStation has expanded passkey support this year. So the original comparison is wrong that PlayStation went quiet. I did not verify the FIDO Alliance figures it quotes (a 24% faster sign-in and 88% enrollment), so I'm leaving them out.
Epic and GOG: documented 2FA, thin evidence on the rest
Epic's support page confirms 2FA by email, SMS or authenticator app. You choose a primary method under Password and security. Epic requires 2FA for some activities, such as claiming certain free games and sending Fortnite gifts. That page documents two-factor options only. It doesn't prove whether Epic offers passkey sign-in, and the launcher-speed claims in the comparison say nothing about authentication.
GOG's claims couldn't be checked against official GOG material. The distinction in the comparison is still worth keeping. Losing access to your account is a different problem from losing the ability to run a DRM-free installer you have already downloaded. The comparison doesn't establish GOG's login options, though, and DRM-free doesn't apply to every feature or title.
What this means for you
The original ranking rests on shaky ground, so I would skip it. Use this instead:
| Platform | What its documentation supports |
|---|---|
| Steam | Password plus Steam Guard (email code or mobile authenticator). Passkeys aren't documented in the pages reviewed. |
| Microsoft/Xbox | Passkeys, plus a separate passwordless option. Legacy exceptions apply. |
| Nintendo | Passkeys that sit alongside password sign-in, with email or 2-Step verification as a fallback. |
| PlayStation | Passkeys documented with setup, management and revert steps. |
| Epic | Email, SMS or authenticator 2FA documented. Passkey status not established. |
| GOG | Not verified. |
Passkeys resist phishing, but they don't fix everything. A compromised device, a weak recovery path or an unlocked shared machine can still put you at risk. Steam's own warning about email-based resets applies everywhere. A hijacked inbox can undo a lot of good security elsewhere.
Action checklist
- Enable a passkey on Microsoft, Nintendo and PlayStation accounts where you can, using your own personal device.
- Test the passkey from a second device before removing anything.
- Decide deliberately whether to turn off SMS, passwords or other fallbacks. Remember that older apps and consoles may still need a password.
- On Steam, enable the mobile authenticator, secure your email account, and review authorized devices.
- Re-read each platform's own settings page before trusting any third-party ranking. Gaming platforms change these options without much warning.
The takeaway is simple. Passkey support in gaming is broader than that comparison says. Steam's gap is real in the documentation we could review, but it is not proven beyond it.