In short
Passkeys replace passwords with cryptographic key pairs that resist phishing. Since April 2026 the NCSC recommends them wherever a service offers them, with a password manager and 2SV where it does not. Business password managers store them alongside passwords: 1Password, Keeper and NordPass can share passkeys, while LastPass saves them but does not share them.
Get a quote for Passkeys for business
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What a passkey is
The NCSC describes a passkey as "a secure, passwordless authentication method that allows you to log into an app and website using your existing device biometrics (like Face ID or fingerprints) or lock screen PIN. Built on the FIDO2 standard, passkeys are a complete alternative to traditional passwords" (NCSC (opens in a new tab)).
The FIDO Alliance, which sets the standard, explains that "Passkeys replace passwords with cryptographic key pairs for phishing-resistant sign-in security" (FIDO Alliance (opens in a new tab)). In practice:
- The website keeps a public key; the private key stays in the person's credential manager and never goes to the website
- Signing in means unlocking the device the usual way: fingerprint, face, PIN or a security key
- Because the passkey is tied to the real website, a fake login page cannot use it
There are two kinds. Synced passkeys are stored in a credential manager and "can be securely synced across a user's devices"; device-bound passkeys stay on one device, such as a hardware security key (FIDO Alliance (opens in a new tab)). The NCSC notes that the password manager on your device is "more accurately called a 'credential manager' as it manages more than just passwords" (NCSC (opens in a new tab)).
What the NCSC said in April 2026
On 23 April 2026, at CYBERUK, the NCSC changed its headline advice:
| NCSC source | What it says |
|---|---|
| News release (opens in a new tab) | "Passkeys should now be consumers' first choice of login across all digital services". Where a service does not support them, "use a password manager to create stronger passwords and keep using two-step verification" |
| Technical blog (opens in a new tab) | "we will begin recommending passkeys wherever a service supports them, and two-step verification (2SV) where it does not"; FIDO2 credentials, including passkeys, "are as secure or more secure than traditional MFA against all common credential attacks observed in the wild" |
| Technical paper (opens in a new tab) | Written for personal use: "this paper is not intended for enterprise risk assessment", although "Whilst this paper's findings likely hold true for organisations as well, the NCSC has not yet formally assessed this" |
The NCSC adds that the change "will be reflected through our ongoing refresh of guidance rather than as a single sudden change". So the April 2026 advice is aimed at consumers and consumer-facing services. For organisations it is a strong signal of direction rather than a new rule.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
What it means for your organisation
Passkeys touch organisations in three places:
| Where | What to consider | Practical step |
|---|---|---|
| Staff accounts on third-party services | More business apps and websites now offer passkeys | Store work passkeys in your business password manager so they are backed up, shared where needed and removed when someone leaves |
| Staff sign-in to your own systems | Your identity platform may support FIDO2 security keys or passkeys for MFA | Plan phishing-resistant MFA for admin and high-risk accounts first |
| Your customers | The NCSC wants consumer services to offer passkeys | If you run a customer login, ask your developers or platform provider about passkey support |
Passwords will be around for years on services that do not offer passkeys. The NCSC's advice for those is unchanged: strong passwords from a password manager and two-step verification. The NCSC paper also says users "should ensure they have phish-resistant (ie, FIDO2) authentication to the sync fabric and a secure account recovery option" (NCSC (opens in a new tab)), which for a business means protecting the password manager account itself with strong MFA.
Passkeys in business password managers
A business password manager lets you treat passkeys like any other work credential. As each vendor describes its support:
| Password manager | Stores passkeys | Shares passkeys | Notes |
|---|---|---|---|
| 1Password | Yes: "a password manager that lets you create, use, and share passkeys" | Yes: "Use shared vaults to make passkeys available to co-workers and family members" | Mac, iOS, Windows and Android (1Password (opens in a new tab)) |
| Keeper | Yes, in the vault, usable "across different browsers and operating systems" | Yes: passkeys "can also be shared with other users like any other record" | Passkey records can be placed in folders; mobile passkeys on Android 14+ and iOS 17+ (Keeper (opens in a new tab)) |
| NordPass | Yes, "on any device with any plan" | Yes: NordPass "lets you create, use, and share passkeys across all your devices" | Mobile app, browser extension, web vault and desktop app (NordPass (opens in a new tab)) |
| LastPass | Yes: passkeys are saved "in your LastPass vault" | No: "You cannot share your passkeys" | Business and Teams admins can disable the "Allow passkeys" policy; passkeys "cannot be exported to a CSV file" (LastPass (opens in a new tab)) |
The FIDO Alliance itself names third-party apps "such as 1Password" as passkey providers alongside built-in ones such as iCloud Keychain and Google Password Manager (FIDO Alliance (opens in a new tab)). Sharing matters for team accounts: if a shared social media or supplier account moves to a passkey, a password manager that can share passkeys keeps the whole team able to sign in.
Is Passkeys for business the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Cyber Essentials v3.3 and passkeys
Cyber Essentials v3.3 (April 2026) updated its definition of passwordless authentication to include FIDO2, and defines passkeys directly: "Passwordless login technology based on public-key cryptography used to securely authenticate a user. This includes FIDO2 authenticators which are considered as Passkeys. FIDO2 authenticators are regarded as MFA because user authentication is performed" (NCSC/IASME (opens in a new tab)).
So a passkey sign-in can count as multi-factor authentication, which Cyber Essentials requires for cloud services. Our specialist site explains the Cyber Essentials MFA requirements (opens in a new tab) in full.
Passwordless sign-in for staff
Storing passkeys for websites in a password manager is one part of going passwordless. The other is how staff sign in to your own identity platform, Microsoft 365 or Google Workspace and internal apps. That is a job for your identity and MFA tools: our sister site covers Cisco Duo passwordless (opens in a new tab) sign-in for staff. The two fit together: passwordless sign-in to the identity platform, then single sign-on into the password manager for everything else.
How we help with passkeys
We can help you adopt passkeys without losing control of shared accounts. We can:
- Help you choose between Keeper, 1Password, NordPass and LastPass, including how each handles passkey sharing and policy
- Set up single sign-on and user provisioning (SSO and SCIM) with Microsoft Entra ID, Google Workspace or Okta, and enforce strong MFA on the password manager itself
- Set passkey and sharing policies and create shared vaults or folders for team accounts
- Help you import existing passwords from browsers, spreadsheets or another password manager
- Supply the licences; they can be billed monthly, with the plan and terms confirmed at quote
Contact us for free advice or a quote.
Frequently asked questions
Do passkeys replace password managers?
No. The NCSC calls the password manager the "credential manager" that creates and keeps passkeys safe, and it still advises a password manager and 2SV for every service that does not yet offer passkeys (NCSC (opens in a new tab)). Business password managers store both.
Can passkeys be shared with colleagues?
With some password managers. 1Password shares passkeys through shared vaults, Keeper shares them like any other record, and NordPass says you can create, use and share passkeys. LastPass saves passkeys but says "You cannot share your passkeys".
Do passkeys count as MFA for Cyber Essentials?
Cyber Essentials v3.3 says "FIDO2 authenticators are regarded as MFA because user authentication is performed", and it treats FIDO2 authenticators as passkeys. Check your assessor's question set for how to answer each question.
Must businesses move to passkeys?
No rule requires it. The NCSC's April 2026 recommendation is aimed at consumers and consumer services, and its technical paper says it is "not intended for enterprise risk assessment". It is a clear direction, so storing passkeys in your business password manager as services offer them is a sensible start.
What happens if someone loses their phone?
Synced passkeys stored in a password manager stay in the vault and are available on the person's other devices once they sign in. Device-bound passkeys, such as those on a hardware key, need a backup key or another sign-in method, so plan recovery before rolling them out.
Still have a question about Passkeys for business?
Ask us and a member of our team will get back to you.