NCSC makes passkeys its first-choice advice for consumer logins

The UK cyber agency’s April guidance recommends passkeys where available, while retaining password managers and two-step verification for services that do not support them.

Britain’s National Cyber Security Centre changed its consumer login advice on 23 April 2026, recommending passkeys as the first choice wherever they are available. The agency, part of GCHQ, said passwords lack the relative resilience needed against modern cyber threats.

The change accompanied a technical report released during the CYBERUK conference in Glasgow. According to the NCSC, the report found passkeys at least as secure as, and generally more secure than, combining the strongest password with two-step verification. That is the agency’s assessment; this report has not independently tested the comparison.

The NCSC had held back from endorsing passkeys the previous year because of implementation challenges. It said progress in the industry now justified recommending them to the public and recommending that businesses offer them as the default consumer authentication option.

The advice retains a fallback for accounts that cannot use passkeys: a password manager to create stronger passwords, together with two-step verification. The recommendation therefore depends on what each service supports.

This is an account of the NCSC’s guidance published on 23 April 2026, not a new announcement. It relies on one official reporting chain. The technical study and individual services have not been independently evaluated for this report.