UK finally drops passwords for its biggest login system
Key Points
- GOV.UK One Login is rolling out passkeys to more than 23 million users
- Passkeys replace passwords with a fingerprint, face scan or device PIN
- More than 300,000 people switched during the initial trial
- Passkey sign-ins run up to 8 times faster and cannot be phished
- Passwords remain available for anyone who prefers them
Passkeys are now rolling out across GOV.UK One Login, giving its more than 23 million users a way to sign in with a fingerprint, face scan or PIN instead of a password, the government said.
The government said more than 300,000 people switched to passkeys during an initial trial, and the option is now opening up to millions more account holders.
GOV.UK One Login is the single sign-in for a growing list of government services, including checking a State Pension, managing tax, renewing a driving licence and accessing childcare support.
A passkey ties a login to a specific device and website, so there is no password for a scammer to steal through a phishing email or fake site. The biometric or PIN data used to unlock it stays on the user’s phone or computer and never reaches GOV.UK One Login.
Passkey logins run up to 8 times faster than entering a username, password and two-step verification code, according to the government.
Nearly one in 10 daily GOV.UK One Login sign-ins now use a passkey, which the government said saves the taxpayer nearly £600 a day in text message costs.
“Nobody enjoys hunting for a forgotten password or waiting for a text message code just to check their tax return or renew a document,” said Stephanie Peacock, Digital Government Minister. “Passkeys mean people can access the services they rely on in seconds, using the same fingerprint or face scan they already use to unlock their phone.”
The National Cyber Security Centre recommends passkeys over passwords because attackers cannot intercept, reuse or steal them.
“Cyber criminals often look for the easiest route to access important accounts, which means login details remain a common target,” said Jonathon Ellison, Director for National Resilience at the National Cyber Security Centre. “But passkeys offer a highly phishing-resistant alternative to passwords, frustrating attackers and saving the public time.”
Ellison added that the NCSC strongly encourages people to set up a passkey for GOV.UK One Login and anywhere else passkeys are offered.
Passkeys remain optional, and anyone who prefers a password can keep signing in the same way as before. The government has published guidance on setting up a passkey for GOV.UK One Login users who want to make the switch.
