Passkeys vs passwords

What a passkey is

The FIDO Alliance, which wrote the standards passkeys are built on (FIDO2), describes a passkey as a sign-in credential stored on your phone or computer, or on a hardware security key. You approve a sign-in the same way you unlock the device: with a fingerprint, face scan, PIN or pattern. You don't type a username and password, and you don't need a separate code.

Behind the scenes, a passkey is a pair of cryptographic keys. The website keeps a public key; your device keeps the private key and never sends it. Each passkey is tied to one website, so a fake site can't use it. NIST's digital identity guidelines class this kind of cryptographic sign-in as phishing-resistant when it meets their requirements, and say that passwords, one-time codes and text-message codes are not.

Passkeys vs passwords

Passwords are secrets you know and type. They fail in predictable ways: people pick weak ones, reuse them across sites, or type them into convincing fake login pages. The NCSC says most cyber harms to individuals start with criminals stealing or compromising login details.

Passkeys remove those failure points. In its April 2026 announcement, the NCSC says passkeys:

• can't be intercepted, reused or guessed like passwords can
• are highly resistant to phishing
• don't need you to create complex passwords, or remember anything at all
• can be up to eight times faster than signing in with a password and a two-step code

The NCSC's research paper, published at the same time, compared passkeys with passwords plus two-step verification (SMS codes, email codes, authenticator apps, push approvals). It found passkeys are as secure as or more secure than the best of those, because traditional codes can still be relayed by a fake site during a live session.

What changed in 2026

In January 2025 the NCSC said it wasn't ready to recommend passkeys for everyone. It listed real problems: losing a device, moving passkeys between providers, confusing wording, and shared family devices.

By April 2026 it had changed its advice. At CYBERUK 2026 it announced that it will recommend passkeys wherever a service supports them, and two-step verification where it doesn't. It said progress across the industry had dealt with enough of the earlier problems to recommend passkeys to the public, and to businesses as the default to offer their customers.

What to watch out for

Passkeys aren't magic, and the NCSC is clear about the remaining risks:

• Account recovery. If attackers can't phish a passkey, they target the "forgot my login" route instead. Protect your email account and your phone number.
• Your credential manager. Synced passkeys are only as safe as the account that syncs them. Give that account a strong password and two-step verification, or a passkey of its own.
• Lost devices. Synced passkeys come back when you sign in on a new device. Device-bound passkeys, such as those on a hardware key, don't, so set up a backup method.
• Shared devices. The NCSC notes that passkeys assume you alone can unlock the device. On a family tablet that several people unlock, that isn't true.

When you still need a password

Plenty of services don't offer passkeys yet, and you'll still need passwords for older systems, Wi-Fi and some work accounts. For those, follow current guidance:

• Make it long. NIST SP 800-63B-4 says services must require at least 15 characters when a password is the only factor, and should allow at least 64.
• Don't force symbols or regular changes. The same NIST guidelines say services shall not impose composition rules or make you change passwords on a schedule; a change is only needed if it's been compromised.
• Use a password manager. That's the NCSC's advice where passkeys aren't available, together with two-step verification.

A passphrase of random words is long and easier to type than random characters. The generator below starts with five random words joined by hyphens, with a capital and a number for sites that still insist on them. It runs in your browser.

How to start using passkeys

1. Open the security or sign-in settings of an account that supports passkeys, such as your email account.
2. Choose to create a passkey and approve it with your fingerprint, face or PIN.
3. Keep your old sign-in method until you've signed in with the passkey on each device you use.
4. Check how your passkeys are backed up, and set up a recovery method you control.

Related guides

• Secure password tips
• Password generator