NCSC Annual Review 2026

Even when combined with two-step verification, passwords and other authentication methods remain vulnerable to phishing and other common attack techniques.

Over the last year, the NCSC has promoted the adoption of passkeys as a safer, simpler and more resilient alternative to passwords. Passkeys replace passwords with cryptographic credentials that are stored securely on users' devices. Because passkeys use public key cryptography and are tied to the legitimate service being accessed, they are significantly more resistant to the weaknesses that have plagued passwords for decades, including password reuse, weak passwords and phishing attacks.

In 2025, the NCSC officially recommended passkeys as the preferred authentication method for individuals. Since then, we’ve been working to accelerate passkey adoption at scale with technology providers and online services, and used CYBERUK 2026 to raise passkey awareness across industry, government and the wider public. The UK is now recognised as a global leader in passkey adoption, with greater uptake with active Google users than in the US or the EU. 

One of the most significant developments this year has been the introduction of passkeys to One Login, the identity service delivered by Government Digital Service (GDS) that enables citizens to access multiple services through a single account. The NCSC provided technical and security expertise to early adopters such as NHS England, the first government-sponsored app to offer passkeys as a login option for its service. This represents a significant milestone in moving passkeys from a security concept to a technology that millions of citizens can use to access services more securely.

Although the NCSC is already working with other departments across government to support wider adoption, passkeys will only deliver their full security benefit if adoption extends beyond government, and becomes commonplace across the services people use every day. Over the coming year, the NCSC will continue working with technology vendors and service providers to encourage implementation and promote good practice. This will be supported by public communications activity designed to help citizens understand why passkeys are both safer and easier to use than traditional passwords.