The UK’s National Cyber Security Centre has advised people to use passkeys instead of passwords. Where an app or website offers the option, the agency says, a passkey should be chosen for logging in — because conventional passwords are not safe enough against the risk of cyber attack.
What a passkey is
A passkey is a way of getting into apps and websites without a password. It is stored on the user’s own device and verifies identity securely to let you into the account. Security specialists sometimes describe it as a “digital seal”.
Using one means there is no separate password to remember. You confirm who you are with your phone’s face recognition, your fingerprint, or a PIN, and the app or website then confirms that the right user is trying to get in.
Why it resists phishing
This is the part that matters, and it is structural rather than a matter of being careful.
In a phishing attack, fraudsters use fake emails, messages or websites to mislead people into handing over their passwords and other login details, which can then spread on the dark web. A passkey is not a piece of information like an ordinary password. There is nothing for you to read out, type into a convincing fake page, or paste into a chat.
A separate passkey is also created for every account. One account’s passkey cannot be used to get into another. And if an app or website that uses passkeys is itself attacked and its data stolen, the attackers cannot easily get into the user’s account with what they took.
Put together, that removes two of the three ways people actually lose accounts: being tricked into revealing a secret, and reusing one secret across sites. We have covered both repeatedly — the hijacked push notification sent to millions of Asos customers, and a single stolen employee login that opened Meta’s GitHub repositories.
The agency’s own argument is about convenience
Dave Chismon, a senior technology specialist at the NCSC, says that although passkeys are technically complex, they are fast and easy for users. Instead of remembering a password or getting through the several steps of two-factor authentication, you can get into an account straightforwardly. So security improves and the login process gets simpler at the same time.
That combination is rare and worth taking seriously. Most security advice asks people to accept friction, which is why most security advice is ignored.
The thing nobody mentions
A passkey lives on your device. So the obvious question — and the one this and most other explainers skip — is what happens when the device is lost, stolen, dropped in water or wiped.
The answer depends on where the passkey is kept. If it is synced through Google Password Manager, iCloud Keychain or a third-party manager, it comes back when you sign in to that account on a new phone, and your exposure shifts to that one account. If it is stored only on the device itself, losing the device means falling back to whatever recovery route the site offers — often an email link or an SMS code, which is to say the weaker method you were trying to leave behind.
So before switching anything important over, settle three things:
Where it syncs. Check whether your passkeys are backed up to an account, and secure that account properly, because it is now the master key.
A second method. Register a passkey on more than one device, or keep a backup method enabled, so a broken phone is not a locked account.
What the recovery path is. Look at how the site lets you back in without the passkey. That path is your real security level, no matter how strong the passkey is.
For readers here there is one further practical point. Passkeys depend on a reasonably modern phone and a working biometric sensor, and they are not yet offered by most local banking and government services — so the near-term reality is passkeys on the big international accounts and passwords, with two-factor authentication, everywhere else. If your recovery still runs through an SMS code, that makes your SIM the thing worth protecting.
Prothom Alo credits the Guardian for the report.
