Passkeys replace the password with a key your device holds and confirms with your face, your fingerprint or a PIN. There is nothing to type, nothing to remember, and nothing an attacker can persuade you to hand over. The NCSC now recommends them over passwords wherever a service supports them.
That recommendation is a change worth noticing. It is also the practical answer to a problem that got worse this year, because the phishing technique that defeats ordinary multi-factor authentication does not defeat this one.
A password can be typed into the wrong site. A passkey cannot. That single property is what separates it from every other authentication method a business is likely to be using today.
What Are Passkeys?
A passwordless way to sign in, built on the FIDO2 standard. The NCSC describes passkeys as a secure, passwordless authentication method that can replace passwords outright. Your device or credential manager creates one per account and keeps it, so there is nothing for you to invent or remember.
What actually gets stored is a private key. The NCSC notes that the credential manager creates and keeps that private key safe and synchronised across your devices, and the matching public key sits with the service you are signing into. The private half never leaves your device.
Before it is used, the device checks it is really you, using whatever already secures that device. Face recognition, a fingerprint, or a PIN. That check happens locally, which is why your biometrics are not being sent anywhere.
How Does a Passkey Actually Work?
Two keys, one of which never moves. The service keeps the public key and sends a challenge. Your device signs that challenge with the private key it holds, and the service checks the signature against the public key it already has. Nothing reusable crosses the network at any point.
Compare that with a password, which is a shared secret. You and the service both know it, which means it can be guessed, reused across sites, leaked in somebody else’s breach, or typed into a convincing copy of the login page. A signature produced on demand has none of those properties.
The part that matters most for phishing is where the key is tied. A passkey is bound to the real site it was created for. Point the browser at a lookalike domain and the device does not produce anything, because as far as it is concerned that is simply a different service.
Wondering Where to Start?
Transputec runs Microsoft 365 identity work alongside a 24/7 UK managed SOC, so the rollout and the monitoring that has to sit behind it come from the same team. Talk to our team about the security work behind your logins.
Get a Strategic ConsultationIs a Passkey MFA, or a Replacement for It?
Both, depending on who is asking, and the distinction trips people up. The NCSC’s corporate guidance on recommended types of MFA ranks FIDO2 credentials first among MFA methods, describing them as giving guessing resistance, phishing resistance and theft resistance. In that context a passkey is MFA, and the best kind available.
Its consumer-facing guidance for the public frames it differently, as a more secure alternative to passwords and to traditional two-step verification. Same technology, different framing for a different audience.
The thing that settles it is user verification. A passkey involves something you have, the device holding the private key, and something you are or know, the biometric or PIN that releases it. Two factors, checked locally, in one gesture.
Practically, you do not need to resolve the terminology. If a compliance form asks whether you have MFA, a passkey satisfies the intent, and it sits above every other option on that ranking.
Why Passkeys Stop Phishing When MFA Does Not
Because there is nothing to relay. The attack that broke MFA for most organisations is adversary-in-the-middle phishing, where a proxy sits between the victim and the real site, passes the login through, and captures the session. Codes get relayed in real time. A passkey produces nothing on the wrong domain.
| Attack | Password alone | Password plus app or SMS code | Passkey |
|---|---|---|---|
| Reused or leaked credential | Works | Blocked by the second factor | Nothing to leak |
| Fake login page | Works | Works, the code gets typed in too | Blocked, wrong domain |
| AiTM proxy, session theft | Works | Works, the code is relayed live | Blocked, nothing to relay |
| Prompt fatigue, approval spam | Not applicable | Works often enough | No prompt to approve |
The middle column is where most UK businesses sit today, and the second and third rows are why that is no longer enough. We covered the mechanics of the proxy attack in our post on AiTM phishing, including Microsoft’s finding that one campaign targeted more than 10,000 organisations.
Where Do Passkeys Fall Short?
Coverage is the honest answer. The NCSC is clear that they are not available everywhere, and where a service does not support them the advice reverts to a strong password from a manager with two-step verification on top. You will be running both models side by side for some time.
Account recovery is the next problem. If the whole point is that nobody can phish the credential, the recovery route becomes the weakest link, and a helpdesk that resets access on a phone call has quietly reopened the door you just closed.
Then there is the device question. They sync through a credential manager, which means the security of that account and of the devices on it now matters more than it did. Shared machines and kiosk logins need thinking about rather than assuming.
None of this is a reason to wait. It is a reason to plan the rollout rather than announce it.
How Should a Business Roll Them Out?
In waves, starting where a compromise would cost most. Finance, payroll, IT administrators and executives first, because those are the accounts an attacker converts into money, and because they are a small enough group to learn on before you touch everyone.
Fix recovery before you fix authentication. Decide now how someone proves who they are when they lose a device, and make sure it is not a phone call to a helpdesk, because that becomes the new attack path the moment passkeys close the old one.
Run them alongside what you have rather than switching overnight. Most services let a passkey and an existing method coexist, so you can move people in groups and keep a route back if something breaks.
Then put policy behind it. Conditional access checking device state and location turns a good credential into a good sign-in, and it is what stops an unmanaged laptop being treated the same as a company one.
What Should You Tell Staff?
Less than you think, because the experience is simpler than what it replaces. They confirm on their device the way they already do and they are signed in. The explaining is mostly undoing the assumption that security has to be inconvenient to be real.
Two points are worth making explicitly. Their fingerprint or face never leaves the device, because that check is local and only releases the key. And losing the phone does not lose the account, provided recovery was set up properly.
Transputec finds the resistance is usually about the unfamiliar rather than the difficult, so a short demonstration beats a long policy document. Let people set one up on a service they already use and the objection tends to disappear.
Your Passkeys Checklist
Before you start, work through these.
- List which of your services actually support them today. That decides the scope.
- Start with finance, payroll, IT admins and executives, not with everyone.
- Decide the recovery process first, and make sure it is not a helpdesk phone call.
- Keep the existing method running alongside during the move.
- Check what happens on shared and kiosk machines before you get there.
- Pair the rollout with conditional access on device state and location.
- Keep strong passwords and 2SV for everything that does not support them yet.
Conclusion
Passkeys are the first authentication change in years that removes a whole class of attack rather than making it harder. The private key never leaves the device and it will not work on a domain it was not created for, which is why a proxy that defeats codes gets nothing. The NCSC recommends them over passwords wherever they are available.
The work is not the technology, it is the sequence: which accounts first, what recovery looks like, and what policy sits behind the sign-in. Transputec does that alongside Microsoft 365 services and cyber security services, so the rollout and the monitoring behind it are not two separate conversations. Talk to us about the security work behind your logins.
FAQs
What Are Passkeys?
A passwordless way to sign in, built on the FIDO2 standard. Your device or credential manager holds a private key for each account and confirms it with your face, fingerprint or PIN. The NCSC describes them as a secure, passwordless authentication method that can replace passwords.
Are Passkeys Safer Than Passwords?
Yes, and the NCSC now recommends them over passwords wherever a service supports them. A password is a shared secret that can be guessed, reused, leaked or typed into a fake site. A passkey is a signature produced on demand, tied to the real domain, with nothing reusable crossing the network.
Do Passkeys Count as Multi-Factor Authentication?
In practice yes. The NCSC’s corporate guidance ranks FIDO2 credentials first among MFA types. A passkey combines something you have, the device holding the key, with something you are or know, the biometric or PIN that releases it, so both factors are present in a single gesture.
Can a Passkey Be Phished?
Not in the way passwords and codes can. The credential is bound to the domain it was created for, so on a lookalike site the device produces nothing. That also defeats adversary-in-the-middle proxies, which relay codes in real time but have no code to relay.
What If I Lose the Device Holding My Passkey?
Nothing, if recovery was set up properly. They sync through a credential manager across your devices, so another trusted device still works. The risk is an organisation that rolls them out without deciding its recovery process, because that becomes the new weak point.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
