The UK government has begun rolling out passkey authentication across GOV.UK One Login, extending passwordless sign-in capabilities to more than 23 million users and strengthening defenses against phishing-led account compromise.
The initiative, announced on September 14, enables citizens to access government services using a device-based passkey authenticated through a fingerprint, Face ID, or local PIN.
The service covers a growing range of public platforms, including childcare services, tax management, State Pension checks, and driver’s license renewals.
UK Government Enables Passkey Login for 23 Million Users
Unlike conventional passwords, passkeys are cryptographic credentials tied to both a user’s device and the legitimate website or application.
This design removes the reusable secret that attackers typically target through credential-harvesting emails, adversary-in-the-middle phishing kits, fake login portals, password spraying, and credential-stuffing attacks.
According to the government, passkey sign-ins can be up to eight times faster than a traditional login flow involving a username, password, and one-time two-step verification code. More than 300,000 people adopted the technology during an initial trial, paving the way for its wider deployment.
Nearly one in 10 daily GOV.UK One Login authentications are already completed with passkeys. The shift is also reducing operational costs: the government said reduced dependence on SMS authentication codes is saving taxpayers nearly £600 per day.
Passkeys are designed to address several inherent weaknesses of passwords and SMS-based multi-factor authentication. A passkey does not expose a password to the user, website, browser, or remote attacker.
Instead, the device verifies the legitimate service domain before using a private cryptographic key to approve the login request.
This origin-bound authentication model means an attacker operating a spoofed GOV.UK site should be unable to trigger a valid passkey authentication for the real government domain.
Even if victims are persuaded to visit a fake page, no password or reusable SMS code is available for theft.
The biometric information used to unlock a credential also remains on the individual’s phone, computer, or security-enabled device. GOV.UK One Login does not receive or store a user’s fingerprint, facial scan, or device PIN, reducing privacy exposure associated with centralized biometric repositories.
Digital Government Minister Stephanie Peacock said passkeys would make access to essential public services faster while improving protection against fraudsters targeting passwords.
The National Cyber Security Center has recommended passkeys as a more secure alternative to passwords, citing their resistance to interception, reuse, and theft.
The technology supports a broader move toward phishing-resistant authentication across public-sector and commercial digital services.
Jonathon Ellison, NCSC Director for National Resilience, said cybercriminals continue to target login credentials as a common route into important accounts. He urged users to enable passkeys where available to improve collective resilience against account takeover attempts.
Users who do not want to adopt passkeys can continue signing in with passwords. However, users who enable the feature can rely on the security controls already built into their devices, eliminating the need to remember complex passwords or wait for SMS verification codes.
For threat defenders, the deployment represents a high-profile national transition away from phishing-susceptible authentication methods and toward cryptographically bound, device-mediated identity verification.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
