If you've signed up for a new Microsoft or Google account lately, you may have noticed something odd: it didn't ask you to make up a password. Instead it wanted your fingerprint, your face, or your phone's lock-screen PIN. That's a "passkey", and in 2026 the big tech companies and the security experts are all steering us away from passwords and towards them. I think it's one of the better security changes to come along in years, and it's worth understanding before your bank or your email provider nudges you into it.
How a passkey works
When you set up a passkey, your phone or computer creates two matching digital keys. The private key stays locked inside your device and never leaves it. The public key is handed to the website you're signing into. When you log in, the two keys do a quick handshake to prove you're you, and you approve it with your fingerprint, face or PIN. As the UK's National Cyber Security Centre explains, the secret half never travels across the internet, so there's nothing for a criminal to intercept, copy or steal from the company's servers. That's the important bit.
Compare that to a password. A password is a shared secret: you know it, and the website stores a version of it. That's two places it can leak from. And every time you type it into a fake login page, a scammer walks off with it.
Why the experts are pushing them
It's more than marketing from the tech giants. In 2026 the NCSC told the public plainly that passkeys should become people's first choice for logging in. It described them as at least as secure as, and generally more secure than, even a strong password paired with two-step verification. The reasoning is simple. The vast majority of account break-ins start with a stolen or tricked-out-of-you password. Take the password away and phishing emails lose most of their bite, because there's nothing for you to accidentally hand over.
The industry is moving the same way. Microsoft now makes a passkey the default sign-in option for new personal accounts, and Google has done much the same. According to the figures shared around World Passkey Day in May 2026, people are now logging in with passkeys well over a billion times a month, roughly double the year before.
The downsides
Passkeys aren't perfect yet. Know these before you start:
- Not every website supports them. You'll be using passkeys on some accounts and passwords on others for a good few years yet, so don't bin your password manager.
- They're tied to your devices and accounts. If you rely on the fingerprint reader on one phone and that phone goes in a lake, you need to be sure you can still get in. Usually that's through the passkeys synced to your Google, Apple or Microsoft account, or a backup method.
- Setting them up the first time can feel unfamiliar. Once it's done it's smoother than passwords, but the initial "wait, where's the password box?" moment throws people.
What I'd suggest doing
You don't need to overhaul everything overnight. A sensible order for most home users and small businesses:
- Start with your most important accounts. Email first (it's the master key to everything else), then your Microsoft/Google account, then banking and anything with your card details.
- Add a passkey rather than deleting your password at first. Most services let you keep both, so you've a fallback while you get used to it.
- Make sure you can recover access. Keep at least one backup sign-in method, and if you use a phone's biometrics, know how to get back in if that phone is lost or broken.
- For a business, decide it deliberately. If staff share access to systems, a bit of planning around who holds which passkeys saves a headache later.
Where to start
Passkeys swap the typed password for your fingerprint, face or device PIN. Because the secret part never leaves your device, they shut down the phishing and data-breach tricks that catch most people out. They're not everywhere yet, so passwords aren't gone.
I'd start with your email and main accounts this week. If it sounds fiddly, it's usually a ten-minute job once someone shows you the ropes.
