UK Cyber Chiefs Back Passkeys Over Passwords

Remembering dozens of complex passwords is about to become optional, thanks to a major shift in how Britain's top cybersecurity experts think we should protect ourselves online.

The National Cyber Security Centre announced Thursday it's recommending passkeys as the most secure way to access your accounts. This marks a huge change after decades of password-based security being the default option.

So what exactly are passkeys? Think of them as digital keys that live on your phone or computer. Instead of typing in "Password123" or your dog's name, you simply unlock your device the same way you always do with your fingerprint, face scan, or PIN code.

The technology works through something called public key cryptography. Your device creates two connected keys: one stays safely on your phone, and the other goes to the website you're logging into. When you try to sign in, your device proves you're you without sharing any secret information that hackers could steal.

Apple, Google, and X already let users switch to passkeys. Other major platforms are rolling them out too, following the UK government's adoption of the technology across its digital services last year.

The timing makes sense. Data breaches keep rising, and people struggle to remember unique, complex passwords for every site. Password managers and multi-factor authentication have helped, but they still require extra steps that many people skip.

Jonathan Ellison, the NCSC's director for national resilience, called passkeys "a user-friendly alternative which provide stronger overall resilience." He said they could help relieve "the headaches that remembering passwords have caused us for decades."

The Bright Side

The shift to passkeys represents real progress in making online security both stronger and easier at the same time. For years, security experts have told us to create impossible-to-remember passwords, never reuse them, and add multiple authentication steps. Now technology is finally catching up to what people actually need: protection that just works.

Cybersecurity experts acknowledge passkeys aren't perfect. Losing your device can create access problems, and not every website supports them yet. For sites that don't, the NCSC still recommends password managers and multiple authentication methods.

But Daniel Card from BCS, the Chartered Institute for IT, sees the bigger picture. "Moving from passwords to password managers, app-based MFA, and now passkeys is a step change in reducing risk," he said.

The technology is now supported across all major operating systems and internet browsers, making adoption easier than ever. What was once a patchy, incomplete option has become a viable solution for everyday people.

Your grandma might not need to remember another password ever again.