Passwords are a solved problem. Passkeys (cryptographic credentials stored on your device, backed by Apple, Google, and Microsoft) are the replacement. Amazon has 175 million customers using them. Google, PayPal, and Shopify have rolled them out. The technology works.
Adoption doesn't. Most companies that add passkey support see single-digit opt-in rates. Users get confused by prompts, hit errors they can't explain, and fall back to passwords. The gap between "passkeys exist" and "passkeys work for our users" is where Corbado lives.
Founded by Kostas Pyliouras (Product), Stefan Becker (Engineering), Martin Kellner (Engineering), and Vincent Delitz (Distribution).
This Week's Breakdown: Corbado
What they do: Passkey observability and adoption platform. Corbado doesn't replace your identity provider (IdP, the system that manages user logins, like Okta or Auth0). It sits on top of it. The platform tracks every step of the passkey authentication journey, pinpoints where users fail, and provides tools to increase passkey usage. Think of it as analytics and optimization for passwordless login, not the login system itself.
The numbers: 10,000+ developers on the platform. ~10 employees in Munich, Germany. No disclosed venture funding (backed by PB Holding GmbH, a parent company with 20 years in enterprise software). ISO 27001 and SOC 2 Type II certified. Official AWS partner, recommended by AWS for maximizing passkey adoption with Amazon Cognito. #1 Developer Tool of the Week on Product Hunt (January 2024). Enterprise pricing from $5,000 to $15,000/month. Free tier for individual developers.
How They Built It
| Layer | Choice | Why |
|---|---|---|
| Frontend | React, Next.js | SDKs for every major framework (Vue.js, Svelte, Angular). Job postings list React and Vue.js |
| Backend | Go (Golang) | Performance-critical auth systems. Stefan Becker is a Golang expert with 20+ years of backend experience |
| Core Protocol | FIDO2/WebAuthn | The industry standard for passkeys, backed by the FIDO Alliance (Fast Identity Online, a consortium including Apple, Google, Microsoft) |
| Observability Engine | Proprietary | Tracks client-side signals: passkey prompts, cancellations, failures, cross-device switches. AI-powered root-cause analysis |
| Hosting/Infra | AWS | Certified AWS partner. Listed on AWS Marketplace. Private cloud option in all AWS regions |
| Security | ISO 27001, SOC 2 Type II | Enterprise-grade encryption, continuous monitoring, OWASP-compliant coding standards |
| Integrations | Okta, Auth0, Amazon Cognito, Ping Identity, ForgeRock | Session-bridging pattern. No user migration required |
| SDKs (Open Source) | Go, Python, PHP, Node.js, JavaScript, Flutter | All MIT-licensed on GitHub |
Stack inferred from job postings, about page, AWS partnership blog, and GitHub organization. Corbado hasn't published a full architecture overview.
The Real Story
Kostas Pyliouras spent 13 years as CTO and Executive Board Member at CHECK24, Europe's largest comparison platform. He joined when the engineering team had 50 people. When he left in 2024, it had over 1,000. Along the way, he built the technical foundations for C24 Bank (a CHECK24 subsidiary that secured a European full banking license) and ran authentication systems handling 5,000+ requests per second.
Before CHECK24, Pyliouras and Stefan Becker co-founded two companies together: rapidsoft (a software consultancy, acquired by CHECK24 in 2010) and rapidmail (a German email SaaS with 200,000+ customers, acquired by Positive Group in 2021). They've been building together for over two decades.
When Pyliouras left CHECK24, the next move was rooted in a problem he'd lived with for years. Authentication at scale is brutal. Passwords leak. SMS one-time codes get intercepted. Users forget credentials and flood support channels. Passkeys solve the security side cleanly (no shared secrets, phishing-resistant by design). But getting millions of existing users to switch from passwords to passkeys is an adoption problem, not a technology problem. Nobody was solving that.
Vincent Delitz came at it from a different angle. He'd worked in consulting (BCG, KPMG) and as a software engineer in the US. He started Corbado solo in 2022, researching passwordless authentication. The timing aligned: Apple, Google, and Microsoft had just announced passkey support across their platforms. Delitz connected with the CHECK24 veterans through Munich's startup network. The team that formed combined deep auth infrastructure experience (Pyliouras, Becker, Kellner) with distribution and business strategy (Delitz).
Martin Kellner, an Elite Academy of Bavaria graduate who'd worked at BMW and CHECK24, rounded out the engineering side with full-stack versatility across frontend, backend, native apps, and infrastructure.
Corbado launched on Product Hunt in January 2024 and hit #1 Developer Tool of the Week. That brought 2x website traffic and 4x daily signups. By 2025, they'd secured an AWS partnership (AWS officially recommends Corbado for Cognito passkey adoption) and earned both ISO 27001 and SOC 2 Type II certifications. Not bad for a team of ten.
The Marketing Playbook: Content as the Top of the Funnel
Corbado's growth engine runs on technical content. Vincent Delitz said in a 2024 interview: "If I could start over, I'd invest much more in creating technical blog posts right from the start."
The blog is dense with passkey implementation guides, enterprise deployment playbooks, vendor comparisons (Corbado vs. Hanko, Cognito vs. Corbado), and compliance deep-dives. Each post targets a specific search query a developer or CIAM (Customer Identity and Access Management, the systems companies use to manage consumer logins) team lead would type into Google.
The free tools work the same way:
- Passkeys Debugger: Test passkey flows across browsers and devices
- Passkey-Readiness Analyzer: Check if your app is ready for passkeys
- State of Passkeys: Live tracker of passkey support across platforms
- Passkeys Cheat Sheet: Downloaded 4,000+ times by teams at Ally, Kmart, Octopus Energy, and Stanford CS
Each tool generates traffic. Each download captures a lead. Each blog post builds SEO authority in a niche where the search volume is growing fast (the passkeys market hit $1.48B in 2024). Zero paid ads. Zero sales team. The content does the selling.
The AWS partnership adds enterprise credibility that blog posts alone can't provide. When AWS publishes a post on its official APN (AWS Partner Network) Blog recommending your product for Cognito passkey adoption, that's distribution money can't buy.
How Corbado Makes Money
| Plan | Price/mo | Target | Key Features |
|---|---|---|---|
| Community | Free | Individual developers | Unlimited logins, up to 3 projects |
| Pro | $149 | Small teams | Enhanced features and support |
| Enterprise Public Cloud | $5,000 | Large-scale B2C apps | Full WebAuthn suite, analytics, passkey intelligence, 100 req/s, 3-month event retention |
| Enterprise Private Cloud | $15,000 | Regulated enterprises (banks, payments) | Single-tenant AWS, pen testing, configurable throughput, optional adoption engineer |
The jump from $149/month to $5,000/month is deliberate. The Community and Pro tiers build developer familiarity. The enterprise tiers capture the real revenue from banks, payments companies, and e-commerce platforms that process millions of logins. That's the classic developer-tools playbook: free for builders, expensive for enterprises.
The Global Market: Passkey Authentication
The passkeys market was valued at $1.48 billion in 2024 and is projected to reach $6.51 billion by 2033 (19.7% CAGR). The broader passwordless authentication market (which includes biometrics, hardware tokens, and magic links alongside passkeys) hit $21 billion in 2024, heading toward $55 billion by 2030. FIDO-aligned passkeys, backed by Apple, Google, and Microsoft, are the fastest-growing segment.
The Big Players (Enterprise, Heavily Funded)
| Company | Where | Funding / Scale | Revenue | What Makes Them Different |
|---|---|---|---|---|
| Okta (Auth0) | US | Public ($18B+ market cap) | $2.5B+ (FY2025) | Full identity platform. Acquired Auth0 for $6.5B. Dominant in enterprise IAM (Identity and Access Management) |
| Stytch | US | $126.3M raised, $1B valuation | Not disclosed | Developer-first auth API. Backed by Benchmark, Thrive, Coatue |
| Beyond Identity | US | $105M raised, $1.1B valuation | Tripled revenue in 2022 | Founded by Jim Clark (Netscape). Phishing-resistant MFA (multi-factor authentication). 200 employees |
| Descope | US/Israel | $88M seed | $5.6M (2023) | Drag-and-drop auth builder. 1,000+ orgs. Founded by ex-Demisto team (acquired by Palo Alto Networks for $560M) |
These companies build full identity platforms. Okta manages your entire login stack. Stytch provides the auth API from scratch. Descope lets you drag and drop auth flows. Corbado doesn't compete with any of them directly. It plugs into them.
The Mid Players (Funded, Growing)
| Company | Where | Funding | Revenue / Scale | Target |
|---|---|---|---|---|
| Hanko | Germany | €1.2M (adesso ventures, HTGF) | $0.01/MAU, 10K+ developers, 8.8K GitHub stars | Open-source passkey auth platform |
| Authsignal | New Zealand | $3M seed (Blackbird Ventures) | ~18 employees, banks and airlines | Drop-in passkeys + adaptive MFA |
| Passage (1Password) | US | Acquired by 1Password (Nov 2022) | Part of 1Password's distribution | Passkey Complete and Passkey Flex SDKs |
Hanko is the closest direct comparison. Also German, also targeting developers, also in the passkey space. But Hanko is building an open-source identity platform (an Auth0 alternative). Corbado is building an adoption layer that works with Auth0.
Corbado's Position
| Company | Where | Backing | Scale | Target |
|---|---|---|---|---|
| Corbado | Germany | PB Holding GmbH (no VC) | ~10 employees, 10K+ developers, AWS partner | Passkey observability + adoption for enterprise CIAM |
The Positioning Gap
The big players (Okta, Stytch, Beyond Identity, Descope) build the identity infrastructure. The mid players (Hanko, Authsignal) build alternative identity platforms. Corbado builds neither. It's an optimization layer for an existing system. That's a smaller market surface, but it's also a market with almost no competition. Nobody else is focused specifically on "why aren't your users adopting passkeys, and how do you fix it."
How We Got Here: Passkey Authentication Timeline
| Year | What Happened | Key Event |
|---|---|---|
| 2012 | FIDO Alliance founded | PayPal, Lenovo, and others create the standard that will eventually become passkeys |
| 2018 | WebAuthn becomes a W3C standard | Browsers get native support for passwordless authentication |
| 2019 | FIDO2 certification program launches | Hardware and software vendors can now certify passkey implementations |
| 2022 | Apple, Google, Microsoft announce passkey support | The big three commit to the same standard. Passage acquired by 1Password |
| 2022 | Corbado founded (May) | Vincent Delitz starts building in Munich. CHECK24 veterans join |
| 2023 | Passkeys go live on iOS 16, Android 14, Windows 11 | Consumer devices support passkeys natively for the first time |
| 2024 | Corbado launches on Product Hunt, hits #1 Dev Tool of the Week | Amazon reports 175M customers using passkeys. Passkey market hits $1.48B |
| 2025 | Corbado secures AWS partnership | AWS recommends Corbado for Cognito passkey adoption. ISO 27001 + SOC 2 Type II earned |
| 2026 | Enterprise passkey adoption accelerates | Banks, payments companies, and e-commerce platforms move from pilot to production |
$1.48B market in 2024, projected $6.51B by 2033. The passkey authentication space is growing at 19.7% CAGR. Every company with a consumer login page is a potential customer.
The Pattern You Can Steal
Corbado's playbook has three parts. The first one is the hardest for most founders to accept:
1. Don't replace the incumbent. Sit on top of it. Corbado doesn't ask enterprises to rip out Okta or Auth0. It integrates alongside existing identity providers using session bridging (no user migration needed). This avoids the hardest sale in enterprise software: migration. It also turns potential competitors into integration partners. If you're entering a market with entrenched incumbents, ask yourself: can I build the optimization layer instead of the replacement?
2. Use 20 years of experience as your moat. Pyliouras built auth systems at CHECK24 handling 5,000+ requests per second. Becker co-architected the backend for millions of users. That credibility is why enterprises trust a 10-person startup with their login infrastructure. If your founding team has deep domain experience, make it the centerpiece of your positioning, not a footnote on the about page.
3. Content is distribution for technical products. Corbado's blog, free tools (Passkeys Debugger, Analyzer, Cheat Sheet), and 80-page Banking Passkey Report generate leads without a sales team. AWS published an official recommendation. Product Hunt delivered 4x signups. Each piece of content targets a specific search query from a specific buyer. If you're selling to developers or technical buyers, the blog isn't marketing. It's the product's front door.
Quick Hits
Amazon now has 175 million customers using passkeys, with sign-in six times faster than passwords. When a company that size commits, the authentication standards shift. Every consumer-facing business is now evaluating passkey support. Read more →
Descope closed an $88M seed round (the largest in the auth space) with backing from Lightspeed and Dell Technologies Capital. The ex-Demisto founders are building a drag-and-drop identity platform that now manages hundreds of millions of identities. Read more →
Hanko cut its pricing by 50% in December 2024 (from $0.02 to $0.01 per monthly active user) and open-sourced its core platform. The German competitor to Auth0 and Clerk has 8,800+ GitHub stars and 10,000+ developers. Open-source vs. proprietary is shaping up as the defining fault line in this market. Read more →
What We're Watching
Enterprise passkey rollouts are the real test. Banks and payments companies are moving from passkey pilots to production deployments. Corbado's positioning only works if enterprises actually need a dedicated adoption layer, and don't just build it themselves. The AWS partnership suggests demand is real.
The "layer on top" model needs to scale. Corbado's approach avoids head-on competition with identity platforms, which is smart at 10 people. The risk is that Okta, Auth0, or Cognito build their own passkey analytics and make the layer unnecessary. Speed matters. The window for establishing the category is measured in quarters, not years.
Germany's auth startup cluster is worth watching. Corbado (Munich) and Hanko (Kiel) are both building passkey products from Germany, a country with strong privacy regulation (GDPR home turf) and deep engineering talent. If passkey adoption accelerates in Europe first (driven by eIDAS 2.0 and PSD2 regulations), German startups have a home-field advantage.
Ship it.
— The FounderSpec Team