Summary
Passkeys offer a more usable, secure replacement for passwords and are already supported by most modern devices. At CYBERUK 2026 in Glasgow, the NCSC announced that we will begin recommending passkeys wherever a service supports them, and two‑step verification (2SV) where it does not. This shift will be reflected through our ongoing refresh of guidance rather than as a single sudden change. It is based on extensive engagement with websites, app developers, technology vendors and the FIDO Alliance, alongside significant technical and sociotechnical research carried out by the NCSC. As part of CYBERUK, we published a paper comparing – from an individual user’s perspective – the security properties of traditional multi‑factor authentication (MFA/2SV) and FIDO2 credentials, including passkeys. How we compared different login methods All credentials go through a lifecycle: they are created, stored and used, and often need to be synchronised, revoked or recovered. At different points in that lifecycle, credentials are vulnerable to different types of attack, and not all attackers By breaking authentication down in this way – and focusing on the most common real‑world attack techniques – it becomes possible to compare very different credential types in a consistent and meaningful way.