NCSC: Forget passwords, passkeys are the future
Passkeys are ‘a user-friendly alternative which provide stronger overall resilience’
This new guidance marks a departure from decades of recommending strong passwords, including combining them with other factors (multifactor authentication, MFA).
Where passkeys are available, the NCSC now recommends using them as the default login method, arguing that passwords are vulnerable to phishing and advanced credential theft techniques.
The NCSC notes that most attacks begin with stolen or compromised login details. By contrast, passkeys - which rely on cryptographic key pairs stored on devices rather than shared secrets - are both harder to compromise and easier to use. The security agency’s own research has found that are “at least as secure as, and generally more secure than, pairing the strongest password with two-step verification”.
Jonathon Ellison, director for national resilience at the NCSC, said the shift could significantly simplify online security. “The headaches that remembering passwords have caused us for decades no longer need to be a part of logging in where users migrate to passkeys,” he said. “They are a user-friendly alternative which provide stronger overall resilience.”
What are passkeys?
Passkeys replace passwords with hardware-bound cryptographic credentials that are tied to the user's device.
The user’s device generates a key-pair retains the private key and sends the public key to the app or service, which then verifies the presence of the corresponding private key via a handshake mechanism. Logging in requires local user approval such as biometrics or a PIN; the private key is never transmitted.
They are inherently resistant to phishing and credential stuffing, since each key pair is unique, and no human interaction is required.
The NCSC argues they also significantly reduce user friction, claiming passkey logins can be completed up to eight times faster than username plus password plus MFA combinations.
Industry figures have broadly welcomed the move. Kevin Marriott, director of cyber content strategy and IP at security vendor Immersive, said the announcement removes a longstanding weak point in enterprise security.
“Bad actors are always looking for the weakest link, and for years that has been passwords,” he said. “Even ‘strong’ passwords create an illusion of security, leaving multiple entry points for attackers.”
Adoption by industry, once a sticking point, is growing. Google, eBay and PayPal all support passkeys, and Google data cited by the NCSC suggests the UK leads global adoption, with just over half of active Google users already registered for passkeys.
Computing’s own research among 104 UK IT leaders found that half have adopted passkeys. They are supported by major operating systems, including Windows, ChromeOS, macOS, Android, iOS and many Linux distributions, as well as by browsers such as Chrome, Firefox, Edge and Safari.
Passkeys are more secure, but still not a silver bullet
But while passkeys significantly raise the bar, security specialists caution that they are not a silver bullet.
Jared Atkinson, CTO at adversary-simulation firm SpecterOps, said passkeys dramatically improve what he described as “identity at rest”, but insisted that organisations must still defend against attacks against authenticated sessions (“identity in transit”).
“Once you’ve authenticated legitimately, passkeys and MFA no longer matter,” he told Computing, pointing to browser session and token theft as an ongoing risk.
Atkinson also highlighted implementation pitfalls. Some platforms allow multiple passkeys to be attached to a single account, creating the risk of “shadow credentials” - where an attacker who gains sufficient access can silently add their own authentication method.
“An attacker can backdoor your account with an additional passkey and maintain long-term access,” he noted.
For businesses, it’s important to have a conversation with vendors to achieve the best . Atkinson pointed to suppliers such as Cisco that have historically limited accounts to a single passkey, prioritising detection and recovery over convenience. The trade-off, he said, is usability versus security - particularly when physical devices such as a smartphone or laptop are lost.
Training and behaviour change also remain critical. Marriott warned that success depends on user education as much as cryptography. “Organisations need to take the lead in creating this culture,” he said, arguing for practical, “scenario-based learning”.
Passwords are not dead yet
Last year the NCSC stopped short of endorsing passkeys, citing immaturity and inconsistent support. However, the agency now believes they have reached a tipping point, and is promoting them as a default option both to consumers and businesses.
Where passkeys are not yet available, the NCSC continues to recommend password managers combined with MFA. It also stresses that basic cyber hygiene remains essential, particularly given the risks from endpoint compromise and session hijacking.