UK NCSC Recommends Passkeys Over Passwords

The UK's National Cyber Security Centre announced on Thursday that consumers and businesses should prioritize passkeys over traditional passwords for logging into online services, marking a major shift in cybersecurity recommendations. The guidance was unveiled during the second day of the CYBERUK conference in Glasgow, Scotland, where the NCSC, part of the Government Communications Headquarters, declared passwords insufficient against evolving threats like phishing and data breaches.

Passkeys represent a cryptographic authentication method that stores unique digital keys on users' devices, such as smartphones or laptops, eliminating the need to remember complex combinations of letters, numbers and symbols. Instead, users verify their identity through built-in features like facial recognition, fingerprints or PINs. This process relies on public-key cryptography, where one key remains on the device and another is linked to the specific service, ensuring no sensitive information is shared during login. Experts describe passkeys as resistant to phishing, brute-force attacks and credential stuffing because they cannot be intercepted remotely or guessed.