GOV.UK One Login Expands Passkeys to More Than 23 Million Users

GOV.UK One Login is expanding optional passkey sign-in to more than 23 million account holders following an initial trial with over 300,000 users. A passkey lets a person access government services using the fingerprint, face scan or PIN already configured on a phone, tablet or computer instead of entering a password and text-message code.

The government says passkey sign-ins can be as much as eight times faster than its username, password and two-step verification flow. Nearly one in ten daily One Login sign-ins already uses a passkey, reducing the number of SMS security codes sent by the service and saving close to £600 per day.

Passkeys use public-key cryptography to create a credential tied to the legitimate service. The user unlocks the credential locally, while GOV.UK One Login receives proof that the correct key was used. The biometric information or device PIN never reaches the government service and remains under the device’s security controls.

The design also blocks common phishing techniques because a passkey created for GOV.UK One Login will not work on an impostor website. There is no reusable password for an attacker to guess, steal through a fake sign-in page or apply to another account.

Users can create a passkey after signing in through the account security settings. Depending on the device and password manager, the credential may sync to other devices in the same ecosystem. Passkeys remain optional, and people can continue using the existing password and security-code process.

One Login provides a common account for a growing range of public services, including checking a State Pension, managing tax services and accessing childcare support. HM Revenue and Customs began moving new customers onto the platform as the government consolidated access to departmental systems.

The wider rollout follows National Cyber Security Centre guidance recommending passkeys as a phishing-resistant alternative to passwords. The guidance emphasizes that biometric checks used to unlock a passkey take place on the user’s device rather than being shared with the website.

The government is rolling out the option progressively across existing accounts. People who choose it can use the same One Login account for participating services, with passkey setup managed centrally through their security settings.

Sources: UK Government, GOV.UK One Login Guidance

–

By the ID Tech Editorial Team