The UK's National Cyber Security Centre now recommends passkeys over passwords wherever passkeys are available. For decades, guidance was about stronger passwords and changing them regularly. Where passkeys are not available, the fallback is still a strong, unique password from a password manager, plus two-step verification.
This guide explains what a passkey actually is, which accounts to switch first, and — most importantly — how to switch without locking yourself out. That last part is where most people go wrong, and it is entirely avoidable if you set up recovery before you need it.
What a passkey is, in plain terms
A passkey is a passwordless way to sign in, built on the FIDO2 standard. Instead of a password you remember and type, your device creates a secure credential for that account, and you unlock it the same way you unlock your device: Face ID, a fingerprint, or your lock-screen PIN. The NCSC describes passkeys as a complete alternative to traditional passwords, created, saved, stored, and managed for you on your trusted devices by your chosen credential manager.
Your credential manager is most likely the one built into your device already: Apple Passwords on iPhone and Mac, Google Password Manager on Android and in Chrome, or Samsung Pass on Samsung devices. You can also use a third-party one, for example to synchronise credentials across browsers and devices. The NCSC calls these tools "credential managers" because they now manage more than just passwords.
Why the NCSC prefers them comes down to one property: passkeys are resistant to phishing. A password can be typed into a fake login page, intercepted, reused, or stolen in a breach. A passkey cannot be typed anywhere — your device checks that it is you, and that it is talking to the real service, before it signs in. The NCSC's technical comparison found passkeys always as secure as, or more secure than, two-step verification using the strongest password. The NCSC page also notes, citing Microsoft, that passkey logins can be up to eight times faster. Speed is a bonus; phishing resistance is the reason to switch.
One more property matters first. Your credential manager backs up your passkeys and can sync them to other devices you trust, so losing one device should not mean losing every account. That "should" carries a condition: sync only helps if it is actually set up, and if you have a second trusted device or a recovery route. That condition is the whole of the next section.
Before you switch anything: set up recovery first
Do this before you create your first passkey, not after. It takes five minutes, and it is the difference between a smooth switch and a locked account.
First, make sure your credential manager is syncing: iCloud Keychain/Apple Passwords on iPhone, Google Password Manager sync on Android, Samsung Pass sync on Samsung. If sync is off, a passkey created on one phone lives only on that phone.
Second, give every important account at least two independent ways back in: a synced passkey plus a second passkey on another device, a hardware security key where offered, or recovery codes where offered — saved somewhere safe, not in a note on the same phone.
Third, do not delete your passwords yet. Most services let a passkey and a password exist side by side while you test. Keep the password and two-step verification until you have signed in with the passkey on a second device and confirmed it works there too. Only then is the password a spare rather than a lifeline.
If you run a small business, write the recovery process down for the accounts it depends on — email, banking, cloud admin, supplier portals — before anyone loses a phone. The person who discovers the recovery process should not be the person locked out at 9am on a Monday.
What to switch on first, in order
Work through this order: accounts that unlock everything else first.
1. Your password manager and your main email account
Start with the tool that holds the keys, and the account that resets everything else. If your credential manager itself offers a passkey, set it up first, then your main email account. Email is the master key: whoever controls your inbox can reset most of your other accounts.
2. Banking and payment accounts
Next, any account that moves money: your bank, your card provider, PayPal, and any payment service you use for the business. These are the accounts a phished password hurts most, and the ones most likely to offer passkeys already. If your bank does not offer one yet, leave the strong password and two-step verification in place.
3. Work and admin accounts
Then the accounts that control other people's access: Microsoft 365 or Google Workspace admin accounts, cloud admin consoles, and any service where you are an administrator. An admin account compromised by phishing affects everyone it administers. Switch admin accounts before standard user accounts, and make sure a second admin or documented recovery route exists first.
4. Everything else, as the prompts appear
After that, switch the rest as services offer it. The NCSC suggests looking for passkey options in account security or privacy settings, and watching for prompts encouraging you to upgrade. There is no need to hunt through every account in one sitting. Each passkey added is one fewer password that can be phished.
For each account, the steps are the same: sign in as normal, open the security settings, look for "passkey" or "passwordless", and follow the service's own prompts. Confirm with Face ID, a fingerprint, or your PIN, and the credential manager will save the passkey. Sign out and back in once on that device, then sign in on a second device to confirm sync works too.
Where passkeys are not available yet
Many services still do not offer passkeys. The NCSC's advice for those accounts has not changed: use a strong password, generated by a password manager so it is unique to that service, and enable two-step verification.
Be suspicious of any service that asks you to turn two-step verification off to use a passkey. A passkey replaces the password; it does not require removing every other protection first. If a setup flow seems to ask for that, stop and read its own help page before continuing.
What passkeys do not fix
Passkeys are a genuine improvement, but they are not magic. They do not protect you if someone has unlocked access to your device, they do not fix a service breached in other ways, and they do not help if you have no recovery route and lose every trusted device. They reduce phishing risk dramatically; they do not make any account unbreakable. Keeping devices and apps up to date still matters, because the NCSC pairs passkey adoption with updates.
They also do not remove judgement: your device will not offer a passkey for a service it does not recognise as the real one, so security moves from "did you spot the fake?" to "the device refused to play along".
The short version
Switch passkeys on wherever they are available: credential manager and main email first, banking and payments second, work and admin accounts third, everything else as prompted. Set up sync and a second recovery route first, keep passwords and two-step verification until the passkey is proven on a second device, and where passkeys are not offered, keep a strong unique password plus two-step verification.
Frequently asked questions
What happens if I lose my phone after switching to passkeys?
If your credential manager is syncing, your passkeys are backed up and can sync to another trusted device — that is why sync must be on before you switch. If sync was off, or you have no second device, recovery depends on the fallback you set up for each account: recovery codes, a second passkey, or a hardware security key. This is why recovery is set up first in this guide, not discovered afterwards.Are passkeys really safer than a strong password plus two-step verification?
The NCSC's technical comparison found passkeys always as secure as, or more secure than, two-step verification using the strongest password, principally because passkeys are resistant to phishing — they cannot be intercepted, reused, or stolen like passwords. Where a service does not offer passkeys, a strong unique password plus two-step verification remains the recommended fallback.Get a Free Consultation
If you would like help rolling passkeys out across your business — starting with email, banking, and admin accounts, with recovery documented before anyone switches — get a free consultation. Visuosofts, 174 Wilmslow Road, Manchester M14 5LQ, +44 7387 055617, info@visuosofts.com.
Sources: National Cyber Security Centre, "Passkeys: what you need to know" (ncsc.gov.uk/passkeys); NCSC passkey recommendation announced at CYBERUK 2026, Glasgow, April 2026, as reported by Mobile ID World, Neowin, Biometric Update, and Brussels Signal (April 2026).