Passkey
A passkey is a way to sign in without a password: your phone or computer holds a secret digital key, and you unlock it with your fingerprint, face or device PIN. Cyber Essentials v3.3 lists passkeys as passwordless authentication and states that FIDO2 authenticators, which count as passkeys, are regarded as MFA. They fit option D at A4.3 and A5.5.
- Term
- Passkey
- Also known as
- Passkeys, FIDO2 passkey
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Reviewed against
- Requirements v3.3
What does the term passkey mean in Cyber Essentials?
A passkey is a way to sign in without a password: your phone or computer holds a secret digital key, and you unlock it with your fingerprint, face or device PIN.
Passwordless login technology based on public-key cryptography used to securely authenticate a user. This includes FIDO2 authenticators which are considered as Passkeys.
How does passkey apply to Cyber Essentials?
In plain terms
A passkey works like a car key fob that only opens your car and never leaves your pocket. When you sign in, the website sends a challenge, your device answers it using a secret key it keeps to itself, and you confirm with your fingerprint, face or PIN. There is no password to type, forget or reuse, and because each passkey is tied to the real website, a fake login page cannot collect it.
What Cyber Essentials asks
The user access control section of the NCSC requirements lists passkeys first among its examples of passwordless authentication, in the wording quoted above. It goes on: "FIDO2 authenticators are regarded as MFA because user authentication is performed." So a passkey sign-in can meet the rule that "authentication to cloud services must always use MFA".
In the question set:
- A4.3 (firewall) and A5.5 (external services) include option D, "passwordless", which needs a short description in the notes.
- A7.10 asks how passwords are protected from brute-force attacks, including "where passwords are a backup for a passwordless system".
Common mistakes
- Turning on passkeys but leaving the old password login available with no throttling, lockout or MFA. The fallback still has to meet the password rules.
- Rolling passkeys out to some staff and describing the whole organisation as passwordless. Answer for the accounts as they actually are.
See does passwordless authentication count and the article on passkeys, FIDO2 and Cyber Essentials. Related: passwordless authentication, FIDO2, biometrics.
Related terms
- Passwordless authenticationPasswordless authentication is a method to establish a user's identity that uses a factor other than knowledge, such as FIDO2 authenticators, biometrics, security keys, one-time codes, QR codes or push notifications.
- FIDO2FIDO2 is a set of open standards for signing in with a cryptographic key held on your device or on a physical security key, instead of typing a password.
- BiometricsBiometrics means using a part of your body, such as a fingerprint or your face, to prove who you are instead of typing a password.
- PassphraseA passphrase is a password made of several ordinary words strung together, such as three random words, which is long and hard to guess but easy to remember.
- PasswordA password is a secret string of characters that you type to prove you are the person an account belongs to.
- Password managerA password manager is an app that stores all your passwords in one locked, encrypted place and can create strong new ones for you, so you only need to remember one.
Frequently asked questions
A passkey is a way to sign in without a password: your phone or computer holds a secret digital key, and you unlock it with your fingerprint, face or device PIN. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, passkey comes up at A4.3, A5.5, A7.10. Read those questions against the definition above so your answers use the term the way the assessor will.
Passkey relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.