Singapore’s GovTech agency has begun extending passkey login for Singpass to Android users, widening access to a phishing-resistant authentication method first made available on iPhones in June.
Android users will receive notifications through the Singpass app in phases, prompting them to create a passkey after updating to the latest app version. GovTech said about 800,000 users had created a Singpass passkey by September 9.
A passkey replaces a typed secret with a cryptographic key pair. Singpass stores the private key on the user’s device and registers the corresponding public key with its service, allowing the device to prove possession without transmitting a password or one-time code that a scammer could intercept.
Users authorize the credential through their phone’s security mechanism, which can include fingerprint or facial recognition. The passkey is also tied to the legitimate Singpass service, so it will not complete a login on a fraudulent website designed to capture credentials.
The Android expansion follows the initial Singpass passkey launch for iPhone users. At that stage, GovTech positioned passkeys as an additional option rather than a replacement for QR login, face verification or SMS one-time passwords, and that approach remains in place.
If a phone is lost or stolen, its Singpass app and passkey are automatically deactivated when the user sets up Singpass on another device. Desktop-browser login support is planned by the end of 2026, extending the credential beyond mobile sign-ins.
The rollout addresses a persistent scam channel in Singapore. Phishing was the country’s second most common scam type in 2025, with reported losses of S$39.9 million, according to Singapore Police Force figures cited by GovTech.
Passkeys remove many phishing opportunities, but their surrounding interfaces still require careful design. Security researchers have shown that clickjacking can manipulate how some passkey prompts are presented, reinforcing the importance of trusted operating-system dialogs and clear enrollment flows.
GovTech is working with the Infocomm Media Development Authority and People’s Association to explain the feature and help users who need assistance setting it up. Singpass is Singapore’s national digital identity service for access to government and participating private-sector services.
–
By the ID Tech Editorial Team
