The UK’s National Cyber Security Centre (NCSC), part of intelligence agency GCHQ, has advised the nation to stop relying on passwords and instead adopt passkeys such as face recognition or fingerprints, according to the agency’s statement on April 23, 2026. The shift is driven by hackers’ increasing success in breaking into accounts protected by traditional password combinations. Jonathon Ellison, director for national resilience at the NCSC, described the move as “overhauling decades of practice.”
The NCSC stated that passwords “no longer need to be a part of logging in” where users migrate to passkeys, which the agency characterizes as “a user-friendly alternative which provide stronger overall resilience.” Ellison said: “As we aim to accelerate the UK’s cyber defences at scale, moving to passkeys is something all of us can do to improve the security of everyday digital services and be prepared for modern and future cyber threats.”
We’re being warned to move away from passwords (Image: Getty Images/iStockphoto)
According to the NCSC, the UK is already the leading country for passkey adoption. Just over half of Google’s active users in the UK are registered with a passkey.
Chris Hosking, from cybersecurity company SentinelOne, emphasized that passkeys transfer “the onus for security away from people.” He noted that managing dozens of strong, unique passwords across work and personal accounts is unrealistic, leading users to reuse passwords or retain the same ones for years. Hosking explained: “That’s why so many major breaches start the same way - a popular service with authenticated users gets breached, those passwords and emails land in data dumps on the dark web, triggering a domino effect that compromises multiple sites and systems.”
Passkeys like facial recognition could help stop hackers (Image: Getty Images)
According to Hosking, “Passkeys remove entire classes of attacks, as there’s no password to steal or reuse.”