Passkeys rolled out to 23 million GOV.UK One Login users

The government is rolling out passkeys across GOV.UK One Login, allowing millions of people to access public services using their fingerprint, face recognition or device PIN instead of a password.

More than 23 million One Login users will be able to use the technology to sign into government services, including childcare services and driving licence renewal.

Passkeys use the security features already built into a user’s device and remove the need to remember or enter a password. According to the government, signing in using a passkey can be up to eight times faster than using a username, password and two-step verification code.

The wider rollout follows an initial trial in which more than 300,000 users switched to passkeys. Nearly one in 10 daily One Login sign-ins are now completed using the technology, with the government estimating this is saving taxpayers almost £600 a day in SMS costs associated with verification codes.

Reducing reliance on passwords

As well as making the sign-in process quicker, the government said the move is intended to strengthen security by reducing users’ reliance on passwords.

Passkeys are tied to a specific device and website, meaning they cannot be guessed or reused in the same way as passwords and there is no password for attackers to capture through a phishing email or fraudulent website.

The biometric information or PIN used to unlock a passkey remains on the user’s device and is not seen or stored by GOV.UK One Login.

Digital Government Minister Stephanie Peacock said the technology would allow people to access government services using the same fingerprint or facial recognition technology they already use to unlock their phones.

“This is about making government services simpler and safer for everyone, while giving people stronger protection against the fraudsters who target passwords,” she said.

GOV.UK One Login is being developed as a single sign-in and identity-checking system for government services. It currently provides access to services including checking a State Pension, managing tax services and accessing childcare support.

Protection against phishing

The National Cyber Security Centre (NCSC) recommends passkeys as a more secure alternative to passwords because they are designed to resist phishing and cannot be intercepted or reused like conventional login credentials.

Jonathon Ellison, NCSC director for national resilience, said the introduction of passkeys would provide “a faster, simpler and more secure way” to access government services.

“Cyber criminals often look for the easiest route to access important accounts, which means login details remain a common target,” he said. “But passkeys offer a highly phishing-resistant alternative to passwords, frustrating attackers and saving the public time.”

Passkeys will remain optional. People who prefer to continue signing into One Login using a password will still be able to do so.