GOV.UK One Login is rolling out passkeys to more than 23 million users, letting people sign in with a fingerprint, Face ID or device PIN instead of a password. Passkey sign-in is up to eight times faster than a password plus a 2-step code.
Key facts
- Passkeys are being rolled out across GOV.UK One Login to more than 23 million users.
- A passkey lets people sign in using a fingerprint, Face ID or device PIN instead of a password.
- Passkey logins are up to 8 times faster than signing in with a username, password and 2-step verification code.
- More than 300,000 users successfully switched to passkeys during the initial trial.
- Passkeys are tied to a specific device and website, so they cannot be guessed or reused, and there is no password for a scammer to steal by phishing.
Passkeys are being rolled out across GOV.UK One Login, the sign-in system used for government services, to more than 23 million users. A passkey lets people sign in using a fingerprint, Face ID or device PIN instead of a password. The change affects anyone who uses GOV.UK One Login to reach services such as HMRC, the DVLA or childcare support.
The rollout follows an initial trial in which more than 300,000 users successfully switched to passkeys. GOV.UK One Login is replacing Government Gateway as the single sign-in for government services, on a phased basis. That means the pool of people who could be asked to use a passkey is growing as more services move across.
The practical promise is speed. Passkey logins are up to 8 times faster than signing in with a username, password and 2-step verification code. Instead of typing a password and then waiting for a text message, a person confirms it is them with the same fingerprint, face or PIN they already use to unlock their phone.
Digital Government Minister Stephanie Peacock said people should not have to hunt for a forgotten password or wait for a text code to check a tax return or renew a document. The examples given of affected services include accessing childcare services and renewing a driving licence. Both are routine tasks that many households handle once or twice a year, and both sit inside the GOV.UK One Login system as it expands.
How a passkey actually works
A passkey is a digital credential stored on a device. It is not a password written down somewhere, and it is not a code sent to a phone. When a person sets one up, the device creates a pair of linked keys. One stays on the device. The other is held by the service. Signing in proves the two match, without either side sending a secret across the internet.
To unlock the passkey, the device asks for a fingerprint, a face scan or the device PIN. That step is local. The biometric or PIN information used to unlock a passkey stays on the user's device and is not seen or stored by GOV.UK One Login. The government system receives proof that the check succeeded, not the fingerprint or the PIN itself.
This is the part that differs most from a password. Passkeys are tied to a specific device and website, so they cannot be guessed or reused, and there is no password for a scammer to steal by phishing. A password can be typed into a fake page that looks like the real one. A passkey will not be offered to a fake page, because it is bound to the genuine website.
Setting one up is a short process. A user signs in to GOV.UK One Login as normal, chooses to create a passkey, and confirms with the device's fingerprint, face or PIN. From then on, the device can offer the passkey at sign-in. There is no long string of characters to invent, no security question about a first pet, and no code to copy from a message.
The trade-off is that the passkey lives on the device. It is not a password that can be typed anywhere. It is a credential that belongs to one phone, tablet or computer, linked to one website. That single fact drives most of the practical questions people ask when they first meet the idea.
What it means in practice
For an ordinary person, the day-to-day change is small and mostly welcome. Checking a tax return, renewing a driving licence or reaching childcare services becomes a matter of looking at the phone and confirming with a fingerprint or face. The 8 times faster figure reflects how much of the old routine, the typing and the waiting for a text, simply disappears.
The limits matter too. Because a passkey is tied to a specific device, losing that device means losing the passkey on it. A replacement phone does not automatically carry the passkey across unless the user has a way to move or re-create it. The announcement does not set out a single universal recovery route, and recovery arrangements can vary by device and by account settings.
There is also the question of shared or older devices. A passkey depends on a device that can perform the fingerprint, face or PIN check. Someone using a basic phone, a work laptop they do not control, or a shared family tablet may find the setup less straightforward than someone with a recent handset. The rollout is phased, so not every user meets the option at the same time.
Another gap is coverage. GOV.UK One Login is replacing Government Gateway on a phased basis, which means some services still sit on the older system. A person may use a passkey for one government task and a password for another during the transition. The announcement does not claim that every government service is covered on day one.
The phishing point is the clearest practical gain. A scammer who tricks someone into entering a password on a fake page gets that password. A scammer who tricks someone into trying to use a passkey gets nothing usable, because the passkey will not release itself to a site it is not bound to. That removes one of the most common routes into an account.
Background and what happens next
GOV.UK One Login has been built as a single sign-in for government services, and the passkey rollout is the latest step in that programme. The initial trial put passkeys in front of real users, and more than 300,000 successfully switched. That trial result is the evidence base for widening the option to more than 23 million users.
The direction of travel is consolidation. Government Gateway has served as the sign-in for tax and other services for years. GOV.UK One Login is replacing it on a phased basis, service by service. Passkeys sit inside that wider move, giving users a sign-in method that does not depend on a password or a text code.
Ministerial framing has focused on friction rather than technology. Stephanie Peacock said people should not have to hunt for a forgotten password or wait for a text code to check a tax return or renew a document. That is a description of the problem passkeys are meant to solve, not a claim that every user will adopt them immediately.
What happens next is largely a matter of pace. More services are expected to move onto GOV.UK One Login over time, and passkeys are expected to be offered alongside existing methods as that happens. The announcement does not set a date for the end of password sign-in, and it does not say that passwords will be removed. Users who prefer the old route keep it for now.
For anyone with a GOV.UK One Login account, the sensible reading is that a new option exists and will appear at sign-in. Whether to take it up is a personal choice about convenience and about how comfortable the person is with the device they use. The rules allow either route during the phased transition.
Common questions
What is a passkey and how is it different from a password?
A passkey is a credential stored on a device that lets someone sign in with a fingerprint, Face ID or device PIN instead of a password. It is tied to a specific device and website, so it cannot be guessed or reused, and there is no password for a scammer to steal by phishing. A password is a secret typed into a page, which can be copied by a fake site. A passkey is bound to the real site, so it will not be offered to an impostor. The biometric or PIN check stays on the device.
Do I have to switch to a passkey, or can I keep my password?
The announcement does not say passwords are being removed. GOV.UK One Login is replacing Government Gateway on a phased basis, and passkeys are being rolled out as an option across the system. That means the old sign-in still works for now, and users who prefer it can continue with a username, password and 2-step verification code. The choice is likely to sit alongside the new method rather than replace it immediately. Anyone who wants the faster route can set up a passkey when the option appears.
What happens to my account if I lose my phone?
A passkey is tied to a specific device, so a passkey held only on a lost phone goes with it. The account itself is not lost, because the passkey is one way in rather than the account. Recovery depends on the device and the account settings in place, and the announcement does not set out one universal route. In practice, a user would need to sign in another way and set up a new passkey on the replacement device. Keeping more than one sign-in method available reduces the disruption.
Is a passkey safer than getting a code by text message?
Passkeys remove two common weaknesses. There is no password for a scammer to steal by phishing, and there is no text code to intercept or to wait for. Passkeys are tied to a specific device and website, so they cannot be guessed or reused. A text code can be read from a message or relayed by someone who has taken over a phone number. A passkey will not release itself to a fake site. The biometric or PIN check stays on the device and is not seen or stored by GOV.UK One Login.
Which government services does GOV.UK One Login cover?
GOV.UK One Login is replacing Government Gateway as the single sign-in for government services, on a phased basis. Examples given of affected services include accessing childcare services and renewing a driving licence. Because the move is phased, coverage is not complete, and some services still sit on the older system. A user may therefore meet a passkey option on one task and a password on another during the transition. The rollout reaches more than 23 million users, so the range of covered services is expected to widen over time.
This article is information, not advice. Figures and rules are as stated by the source on the date shown and can change. Check the primary source before acting on anything here.
Last reviewed 14 September 2026
