UK Cybersecurity Agency Says Passwords Are Past Their Prime, Endorses Passkeys as Default Login

On 24 April 2026 the United Kingdom’s National Cyber Security Centre issued a formal advisory declaring that traditional alphanumeric passwords have become insufficient for protecting digital identities and should consequently be superseded wherever possible by cryptographic passkeys stored on users’ devices. The Centre’s recommendation, which explicitly advises that passkeys become the first‑choice authentication mechanism for any application or website supporting the standard, is justified by the agency’s assessment that passwords are vulnerable to phishing, credential stuffing, and large‑scale database breaches that have become routine in contemporary cyber‑crime.

According to the advisory, passkeys, by virtue of being bound to a specific device and employing public‑key cryptography, render the theft of credential material largely moot, thereby offering a level of assurance that passwords, even when supplemented with multifactor authentication, cannot reliably provide. Nevertheless, the timing of the pronouncement invites a degree of institutional self‑reflection, given that the cryptographic protocols underlying passkeys have been standardized for several years and that earlier warnings about password fatigue were already circulating within government circles.

Critics may point out that the NCSC’s pivot, while technically sound, risks overlooking practical hurdles such as the heterogeneous landscape of legacy systems, the uneven distribution of compatible hardware among the populace, and the potential for new attack vectors targeting the device‑bound credential stores themselves. In effect, the policy shift underscores a broader systemic pattern wherein regulatory bodies often await a critical mass of market adoption before endorsing security innovations, thereby perpetuating a cycle in which users are left to navigate insecure legacy practices until the official stamp of approval arrives.

The advisory concludes by urging service providers to integrate passkey support without delay, while simultaneously reminding consumers that the transition will only be as effective as the underlying ecosystem’s readiness to handle key management, user education, and fallback authentication scenarios.

Published: April 24, 2026