Passwords, passkeys and safer sign-ins
Use passkeys where you can; where you cannot, use unique passwords, a password manager and two-step verification.
Last reviewed: October 2026
Passwords are still everywhere, but they are no longer the best way to protect an account. Where a service offers a passkey, that should normally be your first choice.
Use passkeys where they are available
A passkey lets you sign in using the security already built into your phone or computer, for example Face ID, a fingerprint or the device passcode. Unlike a password, the secret is not typed into a website and cannot simply be stolen and reused on a fake login page.
That makes passkeys particularly useful against phishing. The UK National Cyber Security Centre now recommends them in preference to passwords wherever a service supports them.
Start with the accounts that would cause the most damage if compromised: email, Apple/Google/Microsoft accounts, cloud storage, social media and work systems.
When you still need a password
Use a different password for every important account. Reusing a password means one breached service can give an attacker access to several others.
A password manager is the practical way to do this. The safest option is to choose one that only manages passwords (because it means their reputation depends on a single product). Apple users could use the built-in option. We do not recommend browser-based password managers because these apps are bloated, under constant attack, and absolutely not 100% focussed on managing your passwords. In the end though anything is better than simply reusing passwords.
Let the manager generate long random passwords. You do not need to memorise them.
Protect the password manager itself with a strong, unique master password where one is required, and enable the strongest additional authentication it supports.
Turn on two-step verification
If an account does not support passkeys, enable two-step verification (2SV/MFA). An authenticator app or security key is preferable to SMS where the service gives you a choice, but SMS verification is still better than relying on a password alone.
Never approve an unexpected login prompt. Repeated prompts can be an attacker hoping you will eventually tap Approve simply to make them stop.
Do not share credentials casually
Teams often share access because it seems convenient. Resist! Where possible, give each person their own account and permissions instead. It provides accountability and makes it possible to remove access when someone leaves a production without changing a password everyone knows.
If a service genuinely requires a shared credential, store and share it through an approved password manager rather than email, messaging apps or a spreadsheet.
Recovery matters too
Review recovery email addresses and phone numbers for important accounts. Remove old addresses and numbers, store recovery codes somewhere safe, and make sure a critical work account does not depend entirely on one person’s personal phone.
Five things to do now
- Enable passkeys on important accounts where they are offered.
- Put remaining passwords in a password manager and eliminate reuse.
- Turn on two-step verification for accounts without passkeys.
- Review account-recovery details.
- Never approve an authentication request you did not initiate.