Search the blog
Most of the damage we clear up still starts with a password typed into the wrong page. On 23 April 2026 the National Cyber Security Centre (NCSC) said it now recommends passkeys wherever a service supports them, and two-step verification only where it does not, after its technical assessment found passkeys "at least as secure as, and generally more secure than" the strongest password paired with a second step (NCSC, 2026a).
UK consumers are ahead of UK businesses here. Google data quoted by the NCSC shows just over half of active Google users in the UK already have a passkey registered (NCSC, 2026a); a small firm that has switched them on for its Microsoft 365 or Google Workspace tenancy is still rare. Here is what a passkey is, why it beats phishing, where it lives, which admin switches to flip, and how to roll one out without locking anyone out.
What a passkey actually is
The FIDO Alliance, the industry body behind the standard, defines a passkey as a credential that lets you sign in to a website or app "with the same process that they use to unlock their device" — a fingerprint, face or PIN (FIDO Alliance, n.d.). Underneath is a pair of cryptographic keys. At registration your device creates a private key that stays with you and gives the website a public key. At sign-in the site sends a random challenge; your device unlocks the private key with your face or PIN, signs the challenge and returns the signature for the site to check against the public key. No secret crosses the wire and the server holds nothing worth stealing.
The browser side is the W3C's Web Authentication standard, WebAuthn, whose Level 3 draft became a Candidate Recommendation on 26 May 2026. Its key design rule is scoping: a credential "can only be used for authentication with the same entity (as identified by RP ID) it was registered with" (W3C, 2026). The "relying party" is the real website.
Why a fake login page cannot use one
That scoping rule is the whole point. Our phishing article described the proxy login page that forwards your password and six-digit code to the attacker in real time. A passkey defeats it because the browser, not the user, decides which key to offer. The fake page sits on a different domain, so the key registered for the real one is never presented. There is nothing to type and nothing to relay.
The NCSC's CTO for Architecture put it bluntly: "All traditional MFA methods… are inherently phishable", because a code or an approval tap can be relayed, whereas passkeys "cryptographically bind authentication to the legitimate service" (NCSC, 2026b). His assessment assumed neither perfect users nor perfect implementations.
| Method | Can it be guessed or reused? | Survives a fake login page? | Survives the "approve this?" fatigue trick? | Effort for the user |
|---|---|---|---|---|
| Password alone | Yes — reused across sites, leaked in breaches | No | Not applicable | Remember and type it |
| Password + SMS code | Password yes; code can be relayed or intercepted | No | No | Wait for a text, type the code |
| Password + authenticator app | Password yes; code or push can be relayed | No | Only with number matching on | Open app, read or match a number |
| Passkey | No — unique per site, generated by the device, never typed | Yes — bound to the real domain | Yes — nothing to approve remotely | Unlock the device |
Speed is a bonus: Microsoft data cited by the NCSC puts a passkey sign-in at 8 seconds against 69 seconds for a password plus second factor (NCSC, 2025).
Synced or device-bound?
Two flavours exist and your admin policy needs to know the difference.
A device-bound passkey is created and kept on one physical thing and never leaves it: a FIDO2 security key on a keyring, or the Microsoft Authenticator app on one phone. Lose the device, lose the passkey. That suits an administrator account, because Entra ID can verify the authenticator's make and model ("attestation") and refuse anything else (Microsoft, n.d. a).
A synced passkey is created on a device, encrypted, and copied through a cloud passkey provider to your other devices signed in to that provider (Microsoft, n.d. a). The usual providers are:
- Apple Passwords / iCloud Keychain — built into iOS 16 and macOS 13 onwards.
- Google Password Manager — built into Android 9 onwards and into Chrome on Windows, macOS and iOS 17 onwards.
- 1Password, Bitwarden and similar — a browser extension on the desktop, an app on iOS 17 or Android 14 and later (Microsoft, n.d. a).
- Windows Hello — passkeys saved on a Windows PC are unlocked with the machine's own face, fingerprint or PIN; Windows 11 has had a built-in passkey manager since version 22H2 and, from 24H2, a Settings page under Privacy & security > Passkey access that controls which apps may use them (Microsoft, n.d. b).
The NCSC accepts synced passkeys for most people because "most people already rely on similar cloud-based synchronisation for password managers, email and some authenticator apps"; what must be protected is the account doing the syncing (NCSC, 2026b). Your Apple, Google or password-manager account now guards everything else.
Microsoft 365 and Entra ID: the admin switches
Passkeys are included in every Entra ID edition, including Entra ID Free, so there is no licence to buy (Microsoft, n.d. a). The steps:
- In the Entra admin centre go to Entra ID > Security > Authentication methods > Policies > Passkey (FIDO2) and opt in to passkey profiles. Your existing settings become a "Default passkey profile"; up to three are allowed, so administrators can get a stricter profile than everyone else. Opting in is one-way.
- Set Allow self-service set up to Yes, or staff cannot add a passkey from their Security info page.
- In each profile choose device-bound, synced or both, and whether to enforce attestation. Attestation blocks unknown key models but also excludes synced passkeys, so a sensible pattern is one profile for admins (device-bound, attestation on) and one for everyone else (both allowed).
- Target the profile at a pilot group, then all users.
- Optionally add a Conditional Access authentication strength requiring a passkey for sensitive apps.
Two gotchas: a user must have passed MFA within the previous five minutes to register a passkey, and guest users cannot register one (Microsoft, n.d. a).
Google Workspace: the admin switch
Workspace accounts can already use a passkey as the second step of 2-Step Verification. Skipping the password entirely is a separate, off-by-default setting at Admin console > Security > Authentication > Passwordless > Skip passwords, available only on Enterprise, Frontline, Education and Enterprise Essentials Plus editions and Cloud Identity Premium (Google, n.d.). Business Starter, Standard and Plus tenancies still get passkeys, but as a second factor rather than a password replacement.
Three details matter: skip-passwords does not remove anyone's existing password; enrolling a passkey does not switch on 2SV, so enforce that separately; and an admin can restrict passkeys to hardware security keys only, the equivalent of Microsoft's device-bound profile (Google, n.d.).
Step by step for a small business
Suppose a 25-person firm on Microsoft 365.
- Fix recovery first. Every account gets two registered methods before passkeys go on: a passkey plus the Authenticator app for most staff; for administrators a security key plus a second key in the safe. The NCSC warns that as passkeys frustrate attackers, account recovery becomes the next target (NCSC, 2025), so the reset process must be as strong as the login.
- Enable the profiles as above for a pilot group of five for a fortnight.
- Register on the device people actually use — Windows Hello on a company laptop, Authenticator or the platform keychain on a phone. A five-minute walk-through beats a written guide.
- Roll out to everyone, then require phishing-resistant strength for admin roles and finance.
- Only then remove passwords, group by group.
A household is simpler. On each adult's main Google or Apple account, open the security settings and add a passkey; iCloud Keychain or Google Password Manager will put it on their other devices. Repeat for email, banking where offered, and anything holding card details, and make sure the syncing account can be reached if one phone is lost. The NCSC flags shared devices and people who cannot use biometrics as cases passkeys do not yet fit (NCSC, 2025); there, a manager-generated password plus 2SV remains the answer.
Accounts that do not support passkeys yet
There will be some: the payroll portal, an accounting add-on, a supplier's ordering site. For those the NCSC's advice stands — a long, unique, manager-generated password and two-step verification (NCSC, 2026a). Keep a list; it is your residual phishing risk, worth rechecking every six months as vendors add support. A 2024 survey cited by the FIDO Alliance found 53% of respondents had enabled a passkey on at least one account and 22% on every account that offered one (FIDO Alliance, n.d.). The second number is the target.
What to do
For a business this is configuration, not a purchase: opt into passkey profiles or the passwordless setting, pilot with a handful of staff, buy two security keys per administrator, and write the recovery process down. For a home user: add a passkey to your main Apple or Google account today and let it sync. Either way, the next convincing fake login page has nothing to collect.
If you would like us to set this up — profiles, Conditional Access, keys for administrators and a recovery runbook — we will scope it as a fixed piece of work. See our business IT support and home users pages, or get in touch.
Sources
- FIDO Alliance (n.d.) Passkeys. Available at: https://fidoalliance.org/passkeys/ (accessed 25 August 2026).
- Google (n.d.) Allow users to skip passwords at sign-in, Google Workspace Admin Help. Available at: https://knowledge.workspace.google.com/admin/users/allow-users-to-skip-passwords-at-sign-in (accessed 25 August 2026).
- Microsoft (n.d. a) How to enable passkeys (FIDO2) in Microsoft Entra ID, Microsoft Learn. Available at: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-passkeys-fido2 (accessed 25 August 2026).
- Microsoft (n.d. b) Support for passkeys in Windows, Microsoft Learn. Available at: https://learn.microsoft.com/en-us/windows/security/identity-protection/passkeys/ (accessed 25 August 2026).
- National Cyber Security Centre (2025) Passkeys: they're not perfect but they're getting better, 15 January 2025. Available at: https://www.ncsc.gov.uk/blog-post/passkeys-not-perfect-getting-better (accessed 25 August 2026).
- National Cyber Security Centre (2026a) NCSC: Leave passwords in the past — passkeys are the future, 23 April 2026. Available at: https://www.ncsc.gov.uk/news/ncsc-leave-passwords-in-the-past-passkeys-are-the-future (accessed 25 August 2026).
- National Cyber Security Centre (2026b) Passkeys are more secure than traditional ways to log in, 23 April 2026. Available at: https://www.ncsc.gov.uk/blogs/passkeys-are-more-secure-than-traditional-ways-to-log-in (accessed 25 August 2026).
- W3C (2026) Web Authentication: An API for accessing Public Key Credentials, Level 3, Candidate Recommendation Snapshot, 26 May 2026. Available at: https://www.w3.org/TR/webauthn-3/ (accessed 25 August 2026).