SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/sec-passkeys

How does NCSC say passkeys differ from passwords?

They can't be intercepted, reused or stolen like passwords.

Start playing free

  1. They must be written down
  2. They can't be intercepted, reused or stolen like passwords ✔
  3. They expire every 30 days

Why: A passkey is a cryptographic key stored on your device and unlocked with your fingerprint, face or PIN. There is no secret to type, so there is nothing for a phishing page to capture.

Huh, didn't know that: NCSC says where your email provider supports passkeys, enable them for staff accounts as a priority.

The dad joke
What's one step that witches and wizards take to ensure data security? Quill testing.
Like this card?
Play the game

References

Answer: They can't be intercepted, reused or stolen like passwords. A passkey is a cryptographic key stored on your device and unlocked with your fingerprint, face or PIN. There is no secret to type, so there is nothing for a phishing page to capture.

  1. NCSC: Secure your email www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/secure-your-email
    Passkeys can’t be intercepted, reused or stolen like passwords.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyIs a password enough?Security & PrivacyThe UK NCSC suggests combining what to make a strong, memorable password?Security & PrivacyHow does a password manager help against a fake login page?

That's stuff everyone should know.