Passkeys are the strongest multi-factor authentication (MFA) method available to businesses today. For small businesses in the UK that are moving beyond passwords, they offer a practical upgrade path with measurable security benefits.

This guide covers what passkeys are, how they work, and the steps needed to deploy them across your organisation in 2026. It is written for IT decision-makers evaluating authentication options.

What Are Passkeys?

Passkeys replace passwords with cryptographic key pairs. One key stays on your device — your laptop, phone, or security token. The other key is held by the service you are logging into. When you authenticate, the service challenges your device, and the cryptographic exchange confirms your identity without a password ever travelling across the network.

The standard was formalised by FIDO Alliance and the W3C, and has been adopted by Apple, Google, Microsoft, and Meta. Password managers such as 1Password, Bitwarden, and Keypass support passkey sync across devices. Cloud providers including Microsoft 365, Google Workspace, and Okta support passkey authentication for end users.

Passkeys are designed to eliminate password reuse, phishing, and credential stuffing — three of the most common attack vectors against small businesses.

Why Passkeys Matter for UK Small Businesses

The UK's National Cyber Security Centre (NCSC) has recommended the phase-out of password-based authentication in favour of passwordless methods. That guidance is not theoretical. UK SMEs face the same password-based threats that larger enterprises manage: phishing attacks, stolen credential databases, and brute-force login attempts.

Small businesses are particularly exposed. Limited IT resources mean password policies are often weak or unenforced. Staff reuse passwords across personal and work accounts. Helpdesk teams spend time resetting credentials that could be handled by a single passkey enrolment.

Deploying passkeys addresses these issues directly. The adoption curve is steep because the end-user experience is simpler than the password workflow it replaces: no typing, no resetting, no remembering.

How Passkeys Work: The Technical Basics

Each passkey consists of a public–private key pair. The private key never leaves the user's device. The public key is stored by the relying party — the application or service being accessed.

When a user registers a passkey, the device generates the key pair and sends the public key to the service. On subsequent logins, the service sends a cryptographic challenge. The user's device signs the challenge with the private key, and the service verifies the signature using the stored public key.

Two standards govern passkey technology:

• FIDO2 (WebAuthn): The web standard supported by all major browsers. Handles most enterprise and consumer web applications.

• Smart Card 2.0: A newer protocol that extends passkey support to Windows desktop logins and local applications, still maturing in 2026.

Most small businesses will encounter FIDO2-compatible passkeys first. Windows 11, macOS 12+, iOS 16+, and Android 9+ all support passkey storage and usage natively.

Getting Started: An Implementation Checklist

The transition to passkeys does not happen overnight. Here is a practical sequence to follow.

Step 1: Inventory Your Applications

List every application your team uses daily. Categorise them by three types:

1. Cloud SaaS — Microsoft 365, Google Workspace, Slack, Salesforce, accounting platforms. Most of these support passkeys today.

2. On-premises or legacy — Older line-of-business systems that may not support WebAuthn at all. These will need a bridge or a phased approach.

3. Internet-facing services — Customer portals, vendor dashboards, and admin panels that staff access regularly.

This inventory tells you which applications can accept passkeys immediately and which need planning.

Step 2: Choose Your Passkey Storage Strategy

Passkeys need a place to live. The options are:

• Device-bound storage — Stored in the secure enclave of an individual device (Touch ID, Face ID, Windows Hello). Simple but locked to one device.

• Password manager sync — Synced across devices via a password manager such as 1Password or Bitwarden. This is the most practical option for small teams because staff can switch devices without losing access.

• Hardware security keys — Physical USB or NFC tokens (YubiKey, SoloKey). Highest security for privileged accounts. Adds cost and logistical overhead.

Most small businesses should evaluate password manager sync as the default strategy, reserving hardware keys for admin and privileged accounts.

Step 3: Select a Password Manager (If Not Already in Use)

If your team does not already use a password manager, this is the first purchase to make. The manager handles passkey sync, generates strong credentials for legacy applications, and provides a central audit trail.

Key evaluation criteria:

• Cross-platform support (Windows, macOS, iOS, Android, Linux)

• FIDO2/WebAuthn passkey support

• Shared team vault access

• Audit and reporting capabilities

• UK-hosted data residency option (some providers offer this)

Microsoft 365 E3/E5 customers have Entra ID Named Location and passkey support already included. Google Workspace offers passkey support on all tiers. These built-in options should be the first places to look before purchasing a third-party password manager.

Step 4: Enable Passkeys on High-Priority Applications

Start with the applications your team uses most. In most small businesses, that means:

• Email platform (Microsoft 365 or Google Workspace)

• Corporate communications (Slack, Teams, Zoom)

• Financial and accounting software

• Customer relationship management (CRM)

Enable passkey authentication at the organisation level, not per-user. This pushes the configuration consistently and prevents staff from individually opting out.

Step 5: Define a Phased Rollout Plan

Deploy in waves:

1. Phase 1 — IT and admin accounts. Your team goes first. Identify any workflows that break.

2. Phase 2 — Power users. Staff who rely heavily on cloud applications.

3. Phase 3 — Remainder of the workforce. Push to everyone by a set deadline.

4. Phase 4 — Legacy application workarounds. Address applications that cannot accept passkeys directly with temporary bridges or complementary MFA.

Set a target date by which password-based authentication is disabled for supported applications. Communicate this timeline to all staff.

Step 6: Train Your Staff

Passkey adoption fails when staff do not understand how to use them. Training should cover:

• How to create and enroll a passkey

• How to log in using a passkey (biometric confirmation or device PIN)

• What happens when a device is lost or replaced

• How to back up a passkey via password manager sync

• The difference between a passkey and a password

Keep the training to 15–20 minutes. The concept is simple; the resistance is usually psychological — staff are uncomfortable giving up a password they can see.

Step 7: Set a Deprecation Date for Passwords

Once passkeys are working across your core applications, disable password authentication. This forces migration and closes the gap where attackers still target old credentials.

Communicate a firm date. Offer support during the transition. After the deadline, password-based login is simply not available on passkey-enabled applications.

Handling Legacy Applications That Do Not Support Passkeys

Not every system your business uses supports WebAuthn yet. Common examples include older on-premises ERP systems, some vendor portals, and line-of-business applications built before 2020.

Your options for these applications:

1. Complementary MFA — Use an authenticator app (TOTP) as a bridge. This is stronger than a password alone but weaker than a passkey.

2. VPN + VPN-level MFA — Some VPN gateways offer MFA that protects access to internal applications indirectly.

3. Planned replacement — If an application is critical but stuck on passwords, factor passkey support into your next vendor selection cycle.

4. Access review — Ensure no legacy application exposes admin or customer data over the public internet without strong authentication.

Do not use weak passwords on legacy systems as a placeholder. Weak passwords are easier to compromise than any MFA method you will deploy for them.

Passkeys and Compliance: UK Considerations

UK small businesses often operate under compliance frameworks that touch authentication:

• Cyber Essentials — Requires strong authentication for external-facing services. Passkeys satisfy this requirement more robustly than passwords.

• NCSC guidance — The NCSC has published passwordless authentication guidance that aligns with passkey technology. Aligning your rollout with this guidance supports your security posture reviews.

• GDPR — Authentication is not personal data itself, but passkeys reduce the risk of credential breach, which in turn reduces the likelihood of a GDPR reportable incident.

There is no UK regulation that mandates passkeys specifically, but the regulatory trajectory is clear: password-based authentication is being phased out as the acceptable standard.

Measuring Success

Track these metrics after your passkey rollout:

• Adoption rate — Percentage of staff who have enrolled at least one passkey. Target 100% of supported applications within your deadline.

• Helpdesk tickets — Password-reset tickets should drop significantly within the first month.

• Failed login attempts — Phishing-based credential theft attempts should decrease as your applications sunset password authentication.

• Application coverage — Percentage of core applications that support passkey authentication.

Review these metrics quarterly. Applications that do not yet support passkeys should be flagged for your next vendor review cycle.

Frequently Asked Questions

Are passkeys safe if my device is lost?

Yes. A passkey stored in a password manager syncs to your other devices. If you use device-bound passkeys, enrol a second device as backup. Hardware security keys are the most resilient option for critical accounts.

Can passkeys work across different operating systems?

Yes, provided the passkey is stored in a cross-platform password manager. Native device-bound passkeys (Touch ID, Windows Hello) stay on the device they were created on. Password manager sync solves the cross-OS problem.

Do I need a password manager to use passkeys?

Not strictly — passkeys can be stored locally on each device. But for a small business, password manager sync is strongly recommended because it ensures staff retain access when devices change, and it provides central visibility.

When should we disable passwords entirely?

After passkeys are working on all applications your team needs, set a firm date and communicate it clearly. Typically this is 60–90 days from your initial rollout, depending on legacy application coverage.

Next Steps

If your small business is evaluating authentication upgrades, start with a review of your current application inventory and password management setup. A structured approach prevents missed applications and unexpected downtime.

Book a Security Triage Call to map your existing applications and build a phased passkey deployment plan tailored to your team.

For organisations building their broader security posture, review our guidance on Cyber Essentials compliance and managed IT support standards.