What is the difference between a passkey and a password?

A password is a shared secret that must be transmitted to an application to authenticate. A passkey uses asymmetric cryptography: the private key never leaves your device, and only a digital signature is sent. There is no secret for a phisher to steal, no hash for an attacker to crack from a breached database, and nothing to forget or reuse across accounts.

Are passkeys the same as biometrics?

No. Biometrics such as a fingerprint or face scan are the method used to unlock the passkey on your device. The passkey itself is a cryptographic key. The biometric confirms you are the device owner; the passkey handles the authentication with the application. If your device does not support biometrics, a PIN fulfils the same role.

Can I use a passkey across multiple devices?

Yes. Passkeys can be synchronised across your devices via cloud services such as iCloud Keychain, Google Password Manager, or Microsoft's equivalent. You can also use your smartphone as an authenticator for a session on another device by scanning a QR code at the sign-in screen.

Do passkeys replace MFA?

Passkeys satisfy the MFA requirement inherently: they combine device possession (something you have) with biometrics or a PIN (something you are or know). Where passkeys are in use, a separate MFA step is not required. The NCSC considers FIDO2 passkeys to be more secure than passwords combined with most conventional MFA methods.

How should enterprises handle passkeys when employees leave?

Passkeys on personal devices do not expire automatically when an account is disabled. Enterprise security policy should require passkeys associated with a departing employee to be revoked in the same operation as their account disable, within the same timeframe. Integration between your identity lifecycle management platform and your device management system is the mechanism for maintaining that control reliably.

What is a Passkey? Passwordless Authentication

A passkey is a digital key stored on your phone, laptop, or tablet that lets you sign in to an application without a password. When you sign in, your device confirms your identity using biometrics (a fingerprint scan or facial recognition) or a PIN, and uses the passkey to authenticate you automatically. Nothing sensitive is transmitted to the application.

The Problem Passkeys Solve

Traditional password-based authentication places considerable demands on users. Every application should have a unique, sufficiently complex password. In practice, password reuse is widespread, and even well-managed passwords are vulnerable to phishing, data breaches, keyloggers, and brute-force attacks against leaked credential databases.

Passkeys eliminate the shared secret entirely. There is no password to steal, intercept, or guess. The NCSC announced at CYBERUK 2026 that it now recommends passkeys wherever a service supports them, and two-step verification where passkey support is not yet available. That shift is based on extensive technical research and engagement with the FIDO Alliance, confirming that passkeys provide stronger protection than passwords combined with most forms of MFA. NCSC

How Passkeys Work

Passkeys use asymmetric encryption. When a passkey is created for an application, two keys are generated: a private key that stays on your device and never leaves it, and a public key that is registered with the application.

When you sign in, the application sends a challenge to your device. Your device signs that challenge using the private key and returns the signature. The application verifies the signature using the public key. If verification succeeds, you are authenticated. At no point is a password, or any other reusable secret, transmitted.

A separate passkey is created for each application. Passkeys are generated automatically; there is nothing to configure or remember.

Passkeys vs Passwords

	Password	Passkey
What you store	A password you must remember or manage	A private cryptographic key on your device
What is transmitted	Your password (or its hash)	A digital signature only; no secret is sent
Phishing resistance	None; credentials can be intercepted	Full; there is nothing useful for a phisher to capture
Brute-force risk	High for weak or reused passwords	None; the private key never leaves the device
MFA built in	No; requires a separate step	Yes; device possession combined with biometrics or PIN
NCSC recommendation	With strong MFA for high-impact accounts	Preferred for all accounts where supported

Signing in with a passkey requires no password and no second factor entered separately. Modern devices handle identity confirmation through built-in biometric sensors. A fingerprint scan or face recognition confirms you are the device owner, and the passkey handles authentication automatically.

Where biometric hardware is unavailable, a device PIN is used instead. That PIN is local to the device, never transmitted, and the system prevents repeated attempts. The risk of it being stolen through phishing or brute force is minimal.

Passkey Example: GitHub on Windows

The following example shows how to create and use a passkey for a GitHub account on a Windows laptop using Windows Hello biometric authentication.

Create a passkey (one-off setup)

Go to github.com and sign in with your existing username and password.
Go to Settings, then Password and authentication.
Scroll to Passkeys and select Add a passkey.
When prompted, choose Use Windows Hello.
Authenticate using your face or fingerprint.
The passkey is created and stored on your laptop automatically.

The passkey is now linked to your Windows Hello profile and to your GitHub account.

Sign in using your passkey (every subsequent visit)

Go to github.com and click Sign in.
Select Sign in with a passkey.
Windows prompts you: Use your passkey with Windows Hello?
Confirm with your face, fingerprint, or PIN. Sign-in is immediate.

Your username and password are no longer required. This is inherently Multi-Factor Authentication: you confirm identity with something you are or know (biometrics or PIN), and the passkey is on something you have (your device).

The FIDO Standard

Passkeys are built on the FIDO2 standard, maintained by the FIDO Alliance: an industry consortium that includes Microsoft, Google, and Apple. FIDO stands for Fast Identity Online. FIDO2 comprises two technical protocols.

Protocol	Full name	What it does
WebAuthn	Web Authentication	W3C standard for passwordless sign-in between user devices and web applications
CTAP	Client to Authenticator Protocol	Standardises data exchange between hardware authenticators such as YubiKey and user devices

Hardware security keys such as YubiKey use CTAP to communicate with a device, offering an alternative to device-based passkeys for environments where hardware credentials are required.

Passkey Adoption in the UK

All GOV.UK services adopted FIDO-based passkeys as the default login method from Q4 2025, replacing SMS one-time codes across more than 700 million annual logins. Cyber Essentials 2025 formally recognises passkeys as compliant access controls, enabling UK organisations to certify without relying on legacy password-based authentication. Corbado

Google, eBay, and PayPal all support passkeys, and Google data cited by the NCSC indicates that just over half of active Google users in the United Kingdom have registered at least one passkey. Microsoft, Apple, GitHub, Adobe, Amazon, and a rapidly expanding list of other services now support passkeys across their platforms. IdTechWire

Advanced Passkey Scenarios

The basic scenario, signing in with a passkey on the same device it was created on, is the most common. Several more advanced configurations are also supported.

Cross-device synchronisation. Passkeys can be synchronised across multiple devices via the cloud (iCloud Keychain for Apple devices, Google Password Manager for Android, and Microsoft's equivalent for Windows). This allows the same passkey to authenticate across a user's devices without creating a separate passkey on each.

Smartphone as authenticator. If you need to sign in from a device that does not have your passkey installed, the sign-in screen displays a QR code. Scanning it with your smartphone triggers authentication using the passkey on your phone, granting access to the session on the other device.

Benefits of Passkeys

Stronger security. Authentication uses a cryptographic handshake. No password or reusable secret is exchanged, and phishing cannot harvest credentials that do not exist.
Built-in MFA. Passkeys inherently combine something you have (your device) with something you are or know (biometrics or PIN), meeting the MFA standard without a separate step.
Better user experience. There are no passwords to remember or type. A fingerprint scan or face recognition replaces the entire sign-in process for most users.
Fewer passwords to manage. As passkey support expands, the number of applications requiring a standalone password continues to fall.
Platform independence. Cloud synchronisation makes passkeys available across devices without requiring per-device setup.

Passkeys in Enterprise IAM

For personal use, passkeys are a straightforward improvement over passwords. Enterprise deployment requires additional planning.

Centralised management. In an enterprise environment, passkeys must be managed as part of the identity lifecycle. New starters should have passkeys registered or hardware authenticators issued before or on day one of employment. When someone changes role, credentials may need to be updated to reflect the new access scope.

Leavers require immediate revocation. Unlike passwords, which are account-level, passkeys may persist on personal devices after an account has been disabled. Any passkey associated with a departing employee must be revoked within the same window as the account itself. Lingering passkeys on personal devices have been the source of real security incidents in UK organisations.

Integration with device management. Passkeys are stored on user devices, which means integration with your Mobile Device Management (MDM) or Endpoint Management platform is necessary to maintain visibility and control over which passkeys are registered to which accounts.

SSO and passkeys. In organisations using Single Sign-On, the most impactful deployment of passkeys is at the Identity Provider layer rather than at individual applications. A user authenticates to the IdP once using a passkey, and SSO handles all downstream application access. This provides passkey-grade security across the entire application estate without requiring each application to implement FIDO2 independently. Identity Providers including Entra ID already support passkeys in this pattern.