The UK government is set to roll out passkey technology for its digital services later this year as an alternative to the current SMS-based verification system.

The NCSC promises that this will offer a more secure and cost-effective solution that could save several million pounds annually.

Announced on the first day of the government’s flagship cybersecurity event, CYBERUK, the move to implement passkey technology for the government’s GOV.UK services marks a major step forward in strengthening the nation’s digital security.

Passkeys are unique digital keys that are today tied to specific devices, such as a phone or a laptop, that help users log in safely, without needing an additional text message or other code.

When a user logs in to a website or app, their device uses this digital key to prove the user’s identity without needing to send a code to a secondary device or to receive user input.

This method is considered more secure because the key remains stored on the device and cannot be easily intercepted or stolen, making them phishing-resistant by design. As a result, even if someone attempts to steal a password or intercept a code, they would be unable to gain access without the physical device that contains the passkey.

The NCSC considers passkey adoption as vital for transforming cyber resilience at a national scale, and the UK is already leading internationally with the NHS becoming one of the first government organisations in the world to offer passkeys to users.

In addition to enhanced security and cost savings, passkeys offer users a faster login experience, saving approximately one minute per login when compared to entering a username, password, and SMS code.

“The rollout of passkeys across GOV.UK services marks another major step forward in strengthening the UK’s digital defences while improving the user experience for millions,” AI and digital government minister Feryal Clark said.

“Replacing older methods like SMS verification with modern, secure passkeys will make it quicker and easier for people to access essential services — without needing to remember complex passwords or wait for text messages.

“This shift will not only save users valuable time when interacting with government online, but it will reduce fraud and phishing risks that damage our economic growth.”

The NCSC has also announced that it has joined the FIDO Alliance, the global body shaping the future of password-free authentication. This step will allow the UK to play an active role in the evolution of passkey standards.

Recommended reading

• 65% of Cyber-leaders Reuse Old Passwords
• World Password Day: Are Passkeys the Future?
• Kaspersky: 45% of Passwords Could be Hacked Within 1 Minute

“The UK government’s adoption of passkeys across its digital services reflects a profound decision that stands to protect UK citizens while providing the government with greater security and operational efficiency,” executive director and CEO of the FIDO Alliance Andrew Shikiar said.

“By prioritising modern, phishing-resistant authentication, the UK is setting a strong example for both the public and private sectors in the UK and beyond.

“We’re also very pleased that the NCSC has joined the FIDO Alliance, which allows agencies across the UK government to collaborate with other thought leaders in the Alliance to advance the development and deployment of foundational technologies that will strengthen our collective cyber resilience.”

As described in a recent blog, the NCSC views passkeys as the future of online authentication, and is working with vendors and organisations to make passkeys widely available as an option for users.