A checklist for making sign-ins harder to steal, for individuals and small teams: passkeys first, a password manager where passkeys aren’t on offer, and the right kind of multi-factor authentication. Based on NCSC guidance and NIST SP 800-63B-4, checked on 25 October 2026.
The short version
In April 2026 the NCSC said passkeys “should now be consumers’ first choice of login across all digital services”. Where a service doesn’t support them, its advice is “to use a password manager to create stronger passwords and keep using two-step verification” (NCSC, Leave passwords in the past: passkeys are the future, 23 April 2026 (opens in a new tab)). That’s the whole strategy. The rest of this page is how to do it without locking yourself out.
Why passwords alone don’t cut it
Passwords get reused, guessed and typed into fake login pages. The US standards body is not sentimental about them: NIST’s digital identity guidelines state flatly that “passwords are not phishing-resistant” (NIST SP 800-63B-4, section 3.1.1, final July 2025 (opens in a new tab)). Adding a code by text, an authenticator app or a push approval helps a great deal, but it doesn’t close the gap. The NCSC says those traditional methods “are inherently phishable”, because a convincing fake page can relay the code as fast as you type it (NCSC blog, Passkeys are more secure than traditional ways to log in, 23 April 2026 (opens in a new tab)). Passkeys stop credential phishing; they don’t stop an attacker who tricks someone into granting an app access, as our ConnectWise and Storm-0940 piece shows.
Passkeys: what they are and how to start
A passkey replaces the password with a cryptographic key pair. The private half stays on your device, or in your synced credential manager, and you unlock it with your fingerprint, face or device PIN. Because a passkey is tied to the real website, a lookalike site has nothing to ask for. The NCSC’s blog says passkeys “are as secure or more secure than traditional MFA against all common credential attacks observed in the wild” (NCSC (opens in a new tab)).
Your device’s built-in manager will usually store them. The NCSC’s explainer names Apple Passwords, Google Password Manager and Samsung Pass, and prefers the term “credential manager” because these tools handle more than passwords (NCSC, Passkeys: what you need to know, May 2026, PDF (opens in a new tab)). It also notes that a good credential manager keeps a backup, so losing a phone shouldn’t mean losing every account. That only works if the credential manager account itself is well protected, so secure it first.
Start with the accounts that unlock everything else: your main email, then your credential manager or device account, then banking and work accounts. Look for “passkeys” or “sign-in options” in each service’s security settings.
Password managers: for everything else
Plenty of services still don’t offer passkeys. For those, a password manager does the remembering, generates long random passwords, and won’t fill your password into a lookalike site because the address doesn’t match. NIST tells services that they “SHALL allow the use of password managers and autofill functionality” (NIST SP 800-63B-4 (opens in a new tab)), so if a site blocks pasting, the site is the problem.
Free options are fine. The credential manager built into your phone or browser is the simplest. If you’d rather keep one vault across every platform, KeePassXC (opens in a new tab) is free, open-source and stores its vault as a local file, and Bitwarden’s free plan (opens in a new tab) syncs across devices with an account. We have no commercial relationship with either.
What the password rules now say
NIST SP 800-63B-4 is written for services, not users, but it is a useful sanity check on whatever your IT policy says. All of the following come from section 3.1.1 of the final version (opens in a new tab):
| Rule | What NIST SP 800-63B-4 says |
|---|---|
| Minimum length | 15 characters where the password is the only factor; at least eight where it is only used as part of MFA |
| Maximum length | Services should permit at least 64 characters |
| Composition rules | Not to be imposed (no “one capital, one number, one symbol”) |
| Expiry | No forced periodic changes; force a change when there is evidence of compromise |
| Blocklist | Check new passwords against commonly used, expected or compromised values |
| Hints and security questions | Not allowed |
If your policy still demands a fresh password every few months with a special character, it is enforcing habits the standard has dropped. Raise it with whoever owns the policy.
Choosing MFA where passkeys aren’t available
Some second factor is far better than none, and the NCSC still tells people to keep two-step verification on. If you have a choice, prefer phishing-resistant options such as passkeys or hardware security keys. CISA “strongly urges all organizations to implement phishing-resistant MFA” (CISA, Implementing Phishing-Resistant MFA, fact sheet, October 2022 (opens in a new tab)). Where push approval stays, switch on number matching, which CISA calls one of the best interim mitigations against MFA fatigue (CISA, number matching fact sheet, October 2022 (opens in a new tab)). And never approve a prompt you didn’t start. Our phishing checklist covers what to do when one turns up.
For teams: NIST allows synced passkeys up to its middle assurance level, AAL2, but not the top level, AAL3, and requires access to the sync fabric to be protected by “AAL2-equivalent MFA” (NIST SP 800-63B-4, syncable authenticators (opens in a new tab)). Our reading: synced passkeys are fine for most staff, but give administrator and other privileged accounts device-bound keys, such as hardware security keys, because NIST’s top assurance level rules out keys that sync.
The checklist
Strong authentication: passkeys, password managers, MFA (print or pin this; based on NCSC and NIST guidance, checked 25 October 2026)
- ☐ Credential manager account secured first, with its own strong sign-in and recovery set up.
- ☐ Passkeys turned on for email, then banking, then work accounts.
- ☐ Every other account has a unique, long, generated password stored in a password manager.
- ☐ Two-step verification on wherever passkeys aren’t offered, using the strongest option available.
- ☐ Number matching on for any push-approval MFA; unexpected prompts denied and reported.
- ☐ Recovery checked: backup codes stored safely, and a second device or key registered.
- ☐ Policy checked against NIST: no forced expiry, no composition rules, no security questions.
For a fuller comparison of methods, the NCSC’s Authentication methods: choosing the right type (opens in a new tab) is free, and so is everything linked above.
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)