Passkeys in the UK: what the NCSC and GOV.UK One Login mean for you, and how to switch
The National Cyber Security Centre now tells individuals to use passkeys first and passwords only as a fallback, and GOV.UK One Login has rolled them out to millions. Here is what that means and how to make the switch safely.
By OwnYourStack Admin · Published
For years, the standard advice on logging in was to use long, unique passwords and a password manager. In 2026 the advice from the UK’s own cyber agency changed: where a service offers a passkey, use it first.
What the NCSC actually said
On 23 April 2026, on the second day of the CYBERUK conference in Glasgow, the National Cyber Security Centre (NCSC) published “Leave passwords in the past – passkeys are the future”. Its guidance has three parts:
- Individuals should use passkeys as their first login option and stop using passwords wherever a passkey is available.
- Where a service does not support passkeys, use a password manager to create strong, unique passwords and keep two-step verification switched on.
- Businesses running online services should offer passkeys as the default sign-in option for their customers.
“Adopting passkeys wherever you can is a strong step towards a safer, simpler login experience.” — Jonathon Ellison, Director for National Resilience, NCSC
GOV.UK One Login is already doing it
Government has followed its own advice. According to Computing’s report of 15 September 2026, passkeys are being extended across GOV.UK One Login, the account used for services such as checking your National Insurance record for a state pension, managing tax affairs and accessing childcare support.
- More than 23 million people now have the option to sign in without a password.
- An initial trial involved more than 300,000 users.
- Nearly one in 10 daily One Login sign-ins already use a passkey.
- The government says passkeys save about a minute per login and can be up to eight times faster than a password plus a text-message code.
- It also says they already save almost £600 a day in text-message costs.
Passkeys on One Login are optional: you can carry on with a password if you prefer.
Why passkeys are safer
A passkey is a pair of cryptographic keys. The private half stays on your device (or in your password manager) and never leaves it; the website only holds the public half. You unlock it with a fingerprint, face scan or device PIN. Because the passkey is tied to the real website address, a fake login page cannot trick you into handing it over, which is why passkeys resist phishing in a way that passwords and text-message codes do not. There is also no password to leak in a breach — such as the recent ASOS incident — that could be reused elsewhere.
How to switch, step by step
1. Start with the accounts that matter most
Email, your Apple, Google or Microsoft account, banking apps that support them, and GOV.UK One Login. Your email account is the master key to every password reset, so protect it first.
2. Choose where the passkey lives
You can store passkeys in your phone or computer’s built-in keychain (iCloud Keychain, Google Password Manager, Windows Hello) or in a password manager that supports passkeys, such as Bitwarden or 1Password. A password manager is the better choice if you use devices from more than one ecosystem, because the passkeys follow you across them.
3. Create the passkey
In the security settings of the service, look for “passkey”, “sign in without a password” or “set up biometric login”, then approve with your fingerprint, face or PIN.
4. Plan your recovery
Keep at least one backup way back in: a second device with the passkey, recovery codes stored in your password manager, or a hardware security key kept somewhere safe. Do not delete your password or two-step verification until you have tested the passkey on a second device.
5. Keep a password manager for everything else
Most websites still do not support passkeys. For those, the NCSC’s fallback advice applies: a unique password from a password manager, plus two-step verification.
What to watch out for
- Device PIN safety: anyone who knows your phone’s PIN and steals the phone can often approve passkey sign-ins. Use a PIN that is not guessable and shoulder-surf aware.
- Sync accounts: if your passkeys sync through a cloud account, that account needs the strongest protection you can give it.
- Shared computers: use the “use a phone or security key” option rather than saving a passkey on a machine that is not yours.
The direction of travel is clear: passwords are not disappearing overnight, but when a site offers you a passkey, taking it is now official UK advice.
