Passkeys and 2-step verification: how to lock down your accounts

By Cyber Security Alerts Editorial · Published 21 October 2026

What passkeys are, why the NCSC now recommends them over passwords, how they compare with 2-step verification, and a practical order for securing your most important accounts.

Most account takeovers start with a stolen or guessed password. Phishing pages copy a bank or email login, people reuse the same password across sites, and leaked password lists are tried automatically against other services. Two tools now do most of the work of stopping this: passkeys and 2-step verification (2SV). This guide explains what each one is, how they differ and how to set them up in a sensible order.

What is a passkey?

A passkey is a way to sign in without typing a password. According to the National Cyber Security Centre (NCSC), it lets you log in to apps and websites using the same method you already use to unlock your device, such as Face ID, a fingerprint or your screen-lock PIN. Passkeys are built on the FIDO2 standard and are designed as a complete replacement for passwords.

Behind the scenes, your device creates a pair of cryptographic keys for each account. The website keeps the public half; the private half stays in your device's credential manager. When you sign in, your device proves it holds the private key without ever sending it. Because a passkey is tied to the genuine website, a fake login page on a look-alike domain has nothing to capture.

Why the NCSC recommends passkeys

The NCSC's position is direct: it recommends using passkeys over passwords wherever they are available. It gives three reasons:

• They resist phishing. Passkeys can't be intercepted, reused or stolen the way passwords can, which removes one of the most common ways accounts are compromised.
• They are quicker. The NCSC says passkey logins are up to 8 times faster than signing in with a username, password and 2SV code, and there is nothing to remember.
• They are at least as strong as 2SV. The NCSC's technical paper comparing traditional credentials with FIDO2 credentials concludes that passkeys are always as secure as, or more secure than, 2SV used with the strongest password.

What is 2-step verification?

2-step verification, also called multi-factor authentication (MFA), adds a second check after your password. Even if a criminal has your password, they also need the second step. The NCSC's guide to setting up 2SV describes the common forms:

• a code sent by text message;
• a code generated by an authenticator app on your phone;
• a prompt in an app asking you to approve the sign-in;
• a physical security key that you plug in or tap.

Any of these is far better than a password alone. They are not equal, though. Codes sent by text or typed from an app can still be phished if you enter them on a convincing fake page, while security keys and passkeys check which website they are talking to. The NCSC's guidance on choosing authentication methods explains these trade-offs for organisations.

Passkeys or 2SV: which should you use?

Short answer: a passkey if it is offered, and a strong password with 2SV if it is not. The NCSC is clear that where passkeys are not available, you should keep using strong passwords, for example generated by a password manager, and enable 2SV. It describes this as a resilient defence that still works well.

Where your passkeys live

Passkeys are created and stored by a credential manager, which the NCSC notes is the more accurate name for a password manager because it handles more than passwords. For most people this will be the one built into their device, such as Apple Passwords, Google Password Manager or Samsung Pass, unless they have chosen a third-party manager to sync across different browsers and devices.

The credential manager creates and protects your passkeys, checks it's you before using one, keeps a backup so you don't lose access if a device is lost, and can sync passkeys to your other trusted devices. That last point matters: losing a phone shouldn't lock you out, as long as your credential manager account is itself well protected and you know how to recover it.

A practical order for securing your accounts

You don't need to change everything in one evening. Work through your accounts in order of importance. The NCSC's small organisations guide and its 2SV guidance both put email first, because your email can be used to reset almost every other password.

1. Email. Add a passkey if your provider offers one; otherwise turn on 2SV. Check the recovery phone number and recovery email are current.
2. Your credential manager account (Apple, Google, Microsoft or a third-party manager). This now guards everything else, so give it the strongest protection available.
3. Banking and payment accounts, including PayPal and shopping sites that store your card.
4. Social media and messaging, which criminals use to scam your contacts.
5. Everything else, as you next sign in. Look for prompts inviting you to create a passkey.

How to set up a passkey

Exact steps differ between services, but the pattern is similar. The NCSC suggests looking in an account's security or privacy settings or accepting the prompts that many services now show, and creating a passkey straight away when you open a new account.

1. Make sure your phone or computer has a screen lock (PIN, fingerprint or face).
2. Sign in to the account normally, then open its security settings.
3. Choose the option to create or add a passkey.
4. Confirm with your fingerprint, face or PIN when your device asks.
5. Sign out and sign back in to check it works, before removing any older sign-in methods.

How to set up 2SV where passkeys aren't offered

1. Open the account's security settings and look for "2-step verification", "two-factor authentication" or "multi-factor authentication".
2. Choose an authenticator app or security key if offered; a text message code is the fallback.
3. Save the backup codes the service gives you somewhere safe, such as your password manager or a printed copy kept at home.
4. Check how to recover the account if you change phones.

Common mistakes to avoid

• Leaving email unprotected. Securing your bank but not your email leaves a route to reset the bank password.
• Approving unexpected prompts. If you get a sign-in request or code you didn't ask for, someone may have your password. Don't approve it; change the password instead.
• Reading codes out to callers. No genuine bank or service needs your 2SV code over the phone. Treat any request for it as a scam and report it, as explained in our guide to spotting and reporting phishing.
• Losing the backup codes. Without them, recovering an account after losing a phone can be slow.
• A weak device lock. A passkey is only as safe as the screen lock that guards it, so use a PIN that isn't easy to guess.

What about password managers?

Passkeys and password managers work together rather than competing. Most sites still use passwords, and a manager lets you give each one a long, unique password without memorising any of them. Our guide to password managers covers choosing and setting one up.

Sources and further reading

• NCSC: Passkeys: what you need to know
• NCSC: Comparing traditional credentials and FIDO2 credentials for personal use
• NCSC: Setting up 2-Step Verification (2SV)
• NCSC: Authentication methods: choosing the right type
• NCSC: Small organisations guide: secure your important online accounts

Facts and links checked on 21 October 2026. Spotted an error? Tell us and we will correct it.