Passkeys and Password Managers: What to Teach Employees in 2026

In 2026, the most useful login advice for employees is short: use a password manager to create long, unique passwords for every account; switch to passkeys wherever they're offered; and treat unexpected login prompts and codes as a warning sign. Much of the older advice, such as mandatory symbols and changing passwords every 90 days, is now officially discouraged.

That's a problem for security awareness training, because a lot of courses still teach the old rules.

What changed in the official guidance

The US National Institute of Standards and Technology finalized SP 800-63B-4, its digital identity guidelines for authentication, in 2025. Among the changes that matter for training:

• Verifiers shall not impose composition rules such as requiring a mix of character types.
• Verifiers shall not require periodic password changes; a change should be forced only when there's evidence of compromise.
• Passwords should be checked against lists of commonly used, expected or compromised passwords.
• Longer passwords and passphrases should be allowed, and when a password is the only factor, the minimum length is 15 characters.

The logic is straightforward. Complexity rules and forced rotation push people toward predictable patterns like "Summer2026!" followed by "Autumn2026!". Length and uniqueness do more for security.

Teach password managers as the default

Unique passwords for every account are only realistic with a password manager. Training should cover:

• Why reuse is the real risk: when one site is breached, attackers try the same credentials elsewhere.
• How to use the company-approved manager, including the browser extension and mobile app.
• One strong master passphrase, protected with multi-factor authentication.
• Autofill as a phishing check: if the manager doesn't offer to fill in your password, look closely at the website address.

That last point is underrated. A password manager matches credentials to the real domain, so it quietly refuses to autofill on a look-alike phishing site.

Explain passkeys in plain language

A passkey is a sign-in credential based on public-key cryptography, built on standards from the FIDO Alliance and W3C. To employees, it looks like this: you sign in with your fingerprint, face or device PIN instead of typing a password.

The points worth teaching:

• There's no password to steal or type into a fake site. Passkeys are tied to the real website, so a phishing page can't use them.
• Your fingerprint or face doesn't leave your device. It just unlocks the passkey stored there.
• Passkeys can sync across devices through a password manager or platform account, so losing a phone doesn't mean losing access.
• When a site offers a passkey, say yes.

Teach MFA fatigue and code theft

Attackers increasingly target the second factor. Training should cover two behaviors clearly:

1. Never approve a sign-in prompt you didn't start, no matter how many times it appears. Repeated prompts are an attack, and should be reported.
2. Never read out or forward a one-time code to anyone, including someone claiming to be from IT. Real IT teams don't need your code.

This links directly to phishing reporting habits: an unexpected prompt is a reportable event.

Retire these lessons

If your current course includes any of the following, update it:

• "Change your password every 90 days."
• "Include an uppercase letter, a number and a symbol."
• "Write your password down and lock it in a drawer" as the main strategy.
• Lengthy "how to build a complex password" exercises.

Replace them with a short, practical demo: install the manager, save one account, enable a passkey on one service. Ten minutes of doing beats thirty minutes of rules.

Sources

• NIST, SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management (2025)
• FIDO Alliance, Passkeys
• CISA, Secure Our World