The short version
- On 23 April 2026 the NCSC said passkeys should be consumers’ first choice of login. It said businesses should offer them to customers as the default option.
- If a service does not support passkeys, the NCSC’s advice is unchanged. Use a password manager for strong passwords and keep two-step verification on.
- For a small firm the practical job has three parts. Switch on passkeys for the accounts that matter most. Sort out recovery before a phone is lost. Keep multi-factor authentication on everything else.
For as long as most of us have used computers, official security advice has been about making passwords better. That meant longer, unique and backed by a second step. On 23 April 2026 the National Cyber Security Centre changed the starting point. It made an announcement timed for its CYBERUK conference in Glasgow. The NCSC said it would no longer recommend that individuals use passwords where passkeys are available. It said businesses should offer passkeys to consumers as the default way to sign in.
That is a real shift. In a blog post first published in January 2025, the same organisation said it was not yet ready to recommend passkeys for mass adoption. The reason was unresolved practical problems. Its position now is that progress within industry has closed enough of that gap.
What a passkey is
A passkey replaces the password with a pair of cryptographic keys. The website keeps the public half. The private half stays on your phone, laptop or security key. You unlock it with the fingerprint, face scan or PIN you already use for the device. Apple’s documentation makes the central point. The server never holds the private key, so there is no shared secret to steal from it.
Each passkey works only for the site or app it was created for, as Microsoft’s documentation explains. There is nothing to type into a fake login page. That is why the NCSC calls passkeys highly resistant to phishing. The fingerprint or face data does not travel either. Google says of its own accounts that biometric data stays on the device and is never shared with it.
What the NCSC actually said
The announcement came with a technical paper. It compares passwords plus two-step verification with FIDO2 credentials, the standard that passkeys are built on. The NCSC’s summary is that passkeys are at least as secure as the strongest password paired with two-step verification. It says they are generally more secure. It also made these points:
- If a service does not support passkeys, people should use a password manager to create stronger passwords. They should keep two-step verification switched on.
- Online services that offer passkeys can replace SMS verification codes, which cost money to send.
- The NCSC cites data from Google. As of April 2026, just over 50% of active users of Google services in the UK have a passkey registered.
- A passkey login can be completed up to eight times faster than a username, password and verification code.
Note who the announcement is aimed at. It speaks to individuals and to businesses in their role as providers of customer logins. For staff accounts the relevant NCSC document is its guidance on multi-factor authentication for corporate online services. That guidance ranks the options in order of preference. It puts FIDO2 credentials first, ahead of app-based approval prompts and app-generated codes.
What the platforms and the government have done
Microsoft said in a May 2025 announcement that new Microsoft accounts would be passwordless by default. For business identity, its Entra ID documentation describes two kinds of passkey. Device-bound ones never leave a single device, such as a security key. Synced ones are backed up through a provider such as Apple or Google. It recommends security keys for highly regulated industries and users with elevated privileges. It recommends synced passkeys as a convenient, low-cost option for most other users.
Apple syncs passkeys through iCloud Keychain. It says iCloud Keychain is end-to-end encrypted with keys Apple does not know. Google supports passkeys on Google Accounts. Its help page says the password remains available as a fallback. It also says a passkey on a lost or stolen device can be removed from the account’s security settings.
The government said in May 2025 that it would bring passkeys to its digital services as an alternative to SMS codes. On 14 September 2026 it announced the rollout across GOV.UK One Login. It says One Login has more than 23 million users as of September 2026. Passkeys there are optional. As of September 2026 the government says nearly one in ten daily One Login sign-ins already use one.
The caveats the NCSC itself lists
None of this makes passkeys risk-free. The NCSC’s paper and blog are open about the gaps.
- Account recovery becomes the target. Passkeys make phishing harder. So the NCSC expects attackers to go after “forgot my passkey” routes and reset requests instead.
- The sync account matters. Synced passkeys are only as safe as the Apple, Google, Microsoft or password manager account that syncs them. The paper recommends phishing-resistant sign-in and secure recovery options on that account.
- Lost devices. A passkey that lives on one device and is not synced forces account recovery if the device goes. The paper recommends registering a backup passkey.
- Credential managers vary. The paper found substantial differences in how third-party managers protect stored passkeys. It recommends ones that use the operating system’s own security features.
The NCSC’s blog also says that passkeys assume the user has exclusive, private access to a device or account. In my view that points to the two awkward cases for a small firm. The first is shared logins, which fit badly with a credential designed around one person. The second is recovery, which nobody thinks about until a phone is lost.
Where Cyber Essentials fits
If your business holds or wants Cyber Essentials, the requirements document (version 3.3, dated April 2026) applies. It says organisations must implement multi-factor authentication where it is available. It says authentication to cloud services must always use it. The same document lists passkeys as a form of passwordless authentication. It says FIDO2 authenticators are regarded as multi-factor authentication. So moving staff to passkeys and meeting the scheme’s requirement on cloud logins are compatible goals.
What to do now
- List the accounts that would hurt most if taken over. That means email and the admin console behind it, banking, the domain registrar, accounting software and the password manager itself.
- Switch on passkeys where those services offer them, starting with administrators.
- Where there is no passkey option, use a password manager to generate a unique password and keep two-step verification on.
- Secure the account that syncs your passkeys. Set up its recovery options now.
- Register a second passkey for critical accounts, on another device or a hardware security key.
- Write down what happens when someone loses a phone or leaves. Say who can reset what and how identity is checked.
- If you run customer logins, ask your developer or platform provider about offering passkeys. Review how account recovery is protected too.
- If Cyber Essentials matters to you, confirm multi-factor authentication is on for every cloud service in scope.
This article is analysis of published sources as at 2 October 2026. It is general information. It is not a security assessment of any particular business.
Sources
All sources were opened and checked on 2 October 2026. Corrections are handled as set out in the editorial standards.
- NCSC: Leave passwords in the past, passkeys are the future (NCSC, 23 April 2026)
https://www.ncsc.gov.uk/news/ncsc-leave-passwords-in-the-past-passkeys-are-the-future - Comparing the security properties of traditional user credentials and FIDO2 credentials for personal use (NCSC paper)
https://www.ncsc.gov.uk/paper/traditional-user-and-fido2-credentials-personal-use - Passkeys: they’re not perfect but they’re getting better (NCSC blog, first published 15 January 2025)
https://www.ncsc.gov.uk/blog-post/passkeys-not-perfect-getting-better - Passkeys: what you need to know (NCSC)
https://www.ncsc.gov.uk/passkeys - Multi-factor authentication for your corporate online services: recommended types of MFA (NCSC)
https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services/recommended-types-of-mfa - Cyber Essentials: Requirements for IT Infrastructure v3.3, April 2026 (NCSC, PDF)
https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf - UK pioneering global move away from passwords (NCSC, 7 May 2025)
https://www.ncsc.gov.uk/news/government-adopt-passkey-technology-digital-services - Millions of people to benefit from simpler, more secure way to sign in to government services (GOV.UK, 14 September 2026)
https://www.gov.uk/government/news/millions-of-people-to-benefit-from-simpler-more-secure-way-to-sign-in-to-government-services - Pushing passkeys forward: Microsoft’s latest updates for simpler, safer sign-ins (Microsoft, 1 May 2025)
https://www.microsoft.com/en-us/security/blog/2025/05/01/pushing-passkeys-forward-microsofts-latest-updates-for-simpler-safer-sign-ins/ - Passkeys (FIDO2) authentication method in Microsoft Entra ID (Microsoft Learn)
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2 - About the security of passkeys (Apple Support)
https://support.apple.com/en-gb/102195 - Sign in with a passkey instead of a password (Google Account Help)
https://support.google.com/accounts/answer/13548313?hl=en-GB