NCSC Annual Review 2025

Passkeys provide an easier, faster and more secure way to log in. The NCSC would like to see passkeys become the default authentication recommendation, in recognising their critical role in strengthening the UK’s cyber resilience at scale, and reducing systemic risks associated with legacy authentication technologies.

As with many new technologies, organisations need to understand passkeys to realise the benefits they offer. In the last year, the NCSC has established a virtual team to accelerate the adoption of passkeys in the UK, to enable faster, more secure online experiences for all. This team is encouraging providers to design good passkey experiences across their apps and websites, and working with other FIDO Alliance members (who own and develop the passkey standards) to generate national and international momentum for passkey adoption.

We have also explored where UK government can lead by example, such as by giving citizens the option to use passkeys to access a range of public services using the government’s GOV.UK site. This has also included reviewing the regulatory environment and updating rules and standards that underpin how UK organisations offer services to customers to ensure that sites can confidently and safely offer passkeys.

The team has also been gathering statistics and research from various parties, including research to understand personal attitudes towards online identity and account security. We have also been collecting data to understand a range of organisations' readiness, motivations, and concerns for passkey adoption.

In the coming year, the NCSC will be publishing content (such as implementation guides, security papers and guidance) to make it easier for organisations to adopt passkeys, as well as working directly with key organisations to accelerate adoption.