Passkeys in Schools: A Safer Future Without Passwords – But What Happens When Things Go Wrong?

Steve Cullen

3 hours ago

9 min read

Passwords have been part of school life for decades. Teachers use them to access emails, safeguarding systems, management information systems and learning platforms. Pupils use them to access homework, educational resources and online accounts. But could the familiar password soon become a thing of the past?

The National Cyber Security Centre (NCSC) certainly believes that passkeys offer a better alternative. In April 2026, it strengthened its recommendation that people should choose passkeys instead of passwords wherever they are available.

For schools, this could represent a significant improvement in cyber security. However, while passkeys can make accessing systems easier and more secure, they also introduce practical challenges that schools must consider before adopting them. What happens when a teacher loses their phone? What if a pupil's device breaks? Could somebody else gain access using a shared computer? And what happens if the only person able to access a critical school system is suddenly unavailable?

These are not reasons to reject passkeys. They are reasons to introduce them carefully.

What exactly is a passkey?

A passkey is a digital credential that allows someone to access an online account without entering a traditional password. Instead of remembering a combination of letters, numbers and symbols, users typically authenticate themselves using a fingerprint, facial recognition or the PIN used to unlock their device.

Behind the scenes, passkeys use cryptographic technology. A private key remains securely associated with the user's device or credential provider, while a corresponding public key is registered with the online service. When the user signs in, the system verifies that they possess the correct private key without requiring that private key to be transmitted to the website. This is an important distinction. Unlike passwords, passkeys cannot simply be copied from a convincing-looking fake login page and reused by a criminal.

Some passkeys are synchronised securely across a user's devices, while others are tied to a particular device or physical security key. This distinction becomes especially important when considering recovery arrangements.

The NCSC recommends passkeys because they are more resistant to phishing, easier to use and generally provide stronger protection than conventional password-based authentication.

Why should schools consider using passkeys?

Schools hold substantial quantities of personal information, much of it relating to children and young people. This includes safeguarding records, special educational needs information, medical details, staff employment records, financial information and sensitive family circumstances. Unauthorised access to such information can have serious consequences for individuals, as well as significant legal, operational and reputational consequences for the school.

Consider a member of staff receiving an email apparently from their school's IT provider, advising that their Microsoft 365 password must be updated immediately.

The email directs them to a fraudulent website that looks almost identical to the genuine login page. With a conventional password, the member of staff could unknowingly provide criminals with their login credentials. Some forms of traditional multi-factor authentication can also be defeated through sophisticated phishing techniques.

A properly implemented passkey is linked to the genuine service. It will not authenticate against an unrelated fraudulent website. This substantially reduces the risk of credential phishing, although it does not eliminate every form of cyberattack or social engineering.

The advantages – what could go right?

Better protection against phishing. Passkeys are designed to resist fraudulent login websites, reducing a major route into school systems.
Fewer forgotten passwords. Staff and pupils no longer need to remember numerous complex passwords, potentially reducing IT support requests.
Quicker access. A fingerprint, facial recognition or device PIN can make authentication faster, particularly for staff who regularly access several systems.
Reduced password reuse. A passkey for one service cannot be reused as a password on another, avoiding a common weakness in account security.
Improved protection for remote working. Staff accessing approved systems from home can benefit from stronger authentication, provided their devices are appropriately managed.
Potentially better accessibility. Some users may find device-based authentication easier than remembering and typing passwords, although suitable alternatives must remain available.

For example, a school business manager accessing financial systems from an approved laptop could use a device-bound passkey rather than repeatedly entering a password and receiving verification codes. Similarly, a teacher accessing an approved cloud platform could benefit from faster authentication without reducing the protection afforded to sensitive pupil information.

However, the security benefit depends on the whole account configuration. A strong passkey offers limited reassurance if criminals can simply bypass it using a poorly protected password recovery mechanism.

The disadvantages – what could go wrong?

The most obvious weakness is not necessarily the passkey technology itself. It is the school's ability to manage devices, people and unexpected circumstances. Imagine a teacher who uses their personal mobile phone to authenticate access to school systems. During the journey to work, the phone is lost. If that phone contains the teacher's only usable passkey, they may be unable to access their email, teaching resources or other essential systems. Alternatively, consider a school administrator whose laptop fails just before payroll needs to be processed. If access to the payroll system depends entirely on a passkey stored on that laptop, an equipment failure could quickly become an operational problem.

Other potential difficulties include compatibility with older school software, uncertainty over whether staff should use personal devices, and additional costs for managed devices or physical security keys.

A further concern arises where a school allows passkeys to synchronise through personal cloud accounts. The school must understand where credentials are managed, how they can be recovered, and what happens when an employee leaves.

Passkeys therefore need to be considered as part of the school's wider information governance and business continuity arrangements, not simply as an IT upgrade.

Lost, stolen or broken devices: the recovery problem

This is arguably one of the most important considerations for schools. A passkey may be extremely secure, but that security offers little operational benefit if an authorised user cannot access a critical system when they need it.

Schools should distinguish between three situations.

1. A passkey stored only on one device

If the device is lost, damaged or unavailable, the user may lose their normal means of authentication. An alternative registered credential or a secure account recovery process will be needed.

2. A synchronised passkey

Some systems allow passkeys to be securely synchronised across devices through a credential provider. This may make recovery easier, but access will depend on the provider's security and recovery arrangements.

3. A physical security key

A dedicated USB or NFC security key can provide strong authentication without requiring a personal mobile phone. However, the key can still be lost, stolen or damaged.

The sensible solution is to establish recovery arrangements before introducing passkeys.

For example, schools might issue appropriately managed backup security keys to staff with access to critical systems, or register more than one approved authentication method where the service supports it.

Recovery should require suitable identity verification and authorisation. IT support must not simply disable security controls because somebody telephones claiming to have lost their device.

Schools should also maintain a properly controlled emergency access arrangement for essential administrative systems, ensuring that the loss of one person's device cannot prevent the school from functioning.

Importantly, restoring access to a synchronised passkey provider is not necessarily the same as recovering the school account itself. Both processes should be understood and tested.

Shared devices: a particular problem in schools

Unlike many businesses, schools frequently operate classrooms and computer suites where devices are shared by numerous pupils. This creates an important distinction between personal and shared computing environments.

A pupil should not be encouraged to register a personal passkey on a shared classroom computer if that could leave their credential accessible through a profile used by other people. Similarly, staff must not register passkeys in shared browser profiles or leave unlocked sessions available to colleagues.

Schools should consider managed user profiles, automatic sign-out arrangements, secure device configuration and appropriate alternatives for younger pupils. For primary schools, particularly where pupils have additional learning needs, traditional individual logins or other carefully controlled authentication arrangements may remain more practical.

The objective is not to introduce passkeys everywhere regardless of circumstances. It is to choose an authentication method that is both secure and appropriate to the environment.

Common mistakes schools should avoid

Experience with other security changes suggests that the technology itself is only part of the challenge. Implementation and everyday working practices are equally important.

Some common mistakes could include:

Introducing passkeys without testing account recovery. Staff discover that they cannot regain access only after a device has been lost.
Registering the only passkey on a personal phone. A private device becomes an essential dependency for school operations.
Using shared accounts or profiles. This undermines accountability and may expose credentials to unauthorised users.
Assuming that biometrics make everything secure. A device PIN may also unlock a passkey, and a poorly protected or compromised device still presents risks.
Leaving weak fallback authentication enabled. Criminals may target an easier password or account recovery route instead of attacking the passkey.
Failing to remove access when staff leave. Account revocation, device management and credential removal must form part of the leavers process.
Overlooking supply teachers and temporary staff. They may need secure access without being issued the same equipment as permanent employees.
Neglecting accessibility. Not everyone can use fingerprint or facial recognition, and schools must consider reasonable adjustments.
Assuming every system supports passkeys. Some older MIS, safeguarding or specialist education platforms may not offer compatible authentication.
Failing to explain the change. Staff may confuse a device PIN with a school password or misunderstand where their passkey is stored.

What do the DfE, NCSC and ICO expect?

Department for Education

The DfE's Meeting digital and technology standards in schools and colleges guidance is particularly relevant. Its cyber security core standard requires multi-factor authentication for staff accounts accessing cloud services or remotely accessing on-site systems, and for IT administrative accounts. Significantly, the guidance expressly recognises that passkeys may provide an alternative solution where staff use a dedicated device.

The DfE also emphasises unique user authentication, appropriate access privileges, account management, staff training and secure administrative arrangements.

Schools should not interpret this as a requirement to introduce passkeys immediately. Rather, passkeys represent one way of strengthening authentication while meeting the wider security expectations.

National Cyber Security Centre

The NCSC's April 2026 guidance makes a strong case for passkeys, particularly their resistance to phishing and improved usability. It also recognises that traditional two-step verification remains important where passkeys are not supported.

For schools, the key message is to adopt stronger authentication without creating unnecessary complexity or leaving insecure alternatives in place.

Information Commissioner's Office

From a data protection perspective, Article 5(1)(f) of the UK GDPR requires personal data to be processed with appropriate security, while Article 32 requires technical and organisational measures appropriate to the risks.

The ICO does not impose a general legal requirement for schools to use passkeys. However, authentication controls are an important part of protecting personal data against unauthorised access. Schools should therefore assess whether their chosen arrangements provide appropriate protection, taking account of the sensitivity of the information, the likelihood of compromise and the consequences for individuals.

A Data Protection Impact Assessment (DPIA) may be appropriate where the proposed implementation is likely to result in high risks to individuals, particularly if it introduces new processing of biometric or other sensitive information.

Using a fingerprint to unlock a passkey does not automatically mean that the school collects or processes fingerprint data. Often, biometric verification takes place locally on the device. The school should establish precisely what information its chosen system processes before deciding what privacy documentation or assessments are required.

A practical approach for schools

Rather than introducing passkeys across every system simultaneously, schools should adopt a planned and proportionate approach.

Start by identifying the systems where stronger authentication would provide the greatest benefit, particularly email, cloud services, safeguarding systems, financial systems and administrative accounts. IT support should then assess compatibility, device management, credential storage and recovery options. A limited pilot involving selected staff can help identify unexpected problems before wider implementation.

The school should document its arrangements for lost devices, emergency access, temporary staff, accessibility and staff leaving employment. It should also ensure that the Senior Leadership Team, IT support and Data Protection Officer understand their respective responsibilities.

Passkey arrangements should be reflected, where appropriate, in the school's Information Security Policy, Access Control Policy, Acceptable Use Policy, incident procedures and Business Continuity Plan.

The DfE's guidance on IT support reinforces the importance of maintaining accessible instructions for logging in, solving common problems and recovering access.

Final thoughts: better security must also mean dependable access

Passkeys have the potential to remove one of the weakest links in school cyber security: the traditional password. They can make authentication easier, reduce the risk of phishing and improve protection for systems containing sensitive information. However, they are not a complete solution to cybercrime, nor should schools assume that every passkey implementation is automatically secure.

Schools must still consider device security, account management, staff training, recovery procedures, accessibility and business continuity. A teacher unable to access safeguarding information because their only registered device has failed is not experiencing a successful security outcome.

The best approach combines strong authentication with practical, tested arrangements that ensure authorised users can continue working when something goes wrong. The question for schools is not simply whether passkeys are more secure than passwords. It is whether they can introduce them in a way that makes the whole school both more secure and more resilient.