Secordit home
Contact

What is a passkey?

Passkeys let you sign in without typing a password. A digital key is held by your device or credential manager. You confirm it with Face ID, a fingerprint or a PIN. They are built on the FIDO2 standard. The NCSC recommends them over passwords wherever they are available. 123

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. Your credential manager creates and stores a passkey for a site or app that offers them. 12
  2. You sign in by confirming that key on a device you already trust. You use Face ID, a fingerprint or a PIN, rather than typing a password. 1
  3. The manager can back up or sync passkeys to other devices you trust. Losing a device is still a risk if recovery options are not set up. 1

How it can look

The NCSC currently recommends using passkeys wherever a service offers them, including for important online accounts in its small-organisations guidance. Where passkeys are not offered, it still recommends a strong unique password and 2-step verification. 132

Warning signs

  • A site offers passkeys, but you have not set up a recovery method or a second trusted device. 1
  • A message asks you to type a password or a code into a page that is not the real service. That can happen even if you use passkeys on other sites. 12
  • An important account still has only a reused password, because passkeys are not offered there and 2-step verification has not been turned on. 32

What to do now

  1. Turn on passkeys for important accounts that offer them, including email and banking where that option exists. 13
  2. Set up the recovery or sync options in your credential manager, so that losing one device is not the end of every passkey. 1
  3. Where passkeys are not offered, keep a strong unique password and turn on 2-step verification. 23

UK reporting and support

  • If you think an account has been taken over, follow the NCSC help for a hacked account. 4
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 578
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 6
  • If someone is in danger, call 999. 78

How to protect yourself

  • Use passkeys first where a service offers them, and a password manager plus 2-step verification where it does not. 12
  • Keep the device lock (Face ID, fingerprint or PIN) turned on, because that lock also protects the passkey. 1
  • Add a second trusted device or a recovery method before you rely on a single phone. 1

Frequently asked questions

If I set up a passkey on my phone, what happens if I lose the phone?

The credential manager can back up or sync passkeys to other devices you trust, if you have set that up. Losing a device is still a risk if those recovery options are not in place. Use the account-recovery steps on the genuine service, and set those recovery options up in advance. 1

Why does the NCSC say passkeys resist phishing?

Because you are not typing a secret that a fake site can steal and reuse. The key stays with your device or credential manager. This still does not make an account impossible to compromise. 1

Should I still use a password on sites without passkeys?

Yes. Use a strong unique password, ideally from a password manager, and turn on 2-step verification. 23

Matching kit

Account Lockdown Kit · £19 · Digital download.

A self-serve guide to securing email, phone and online accounts. It does not promise to stop every attack.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Passkeys: what you need to know | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  2. NCSC, Password managers | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. NCSC, Secure your important online accounts | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. NCSC, Help for individuals | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  5. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  6. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  7. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  8. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).