UK rolls out passkeys for GOV.UK One Login

The UK government is expanding passkey sign-in for GOV.UK One Login after an initial trial.

Users can sign in with a face or fingerprint biometric scan, or a device passcode, instead of entering a password and security code.

The optional sign-in method is being expanded across a platform with more than 23 million users.

More than 300,000 users switched to passkeys during the trial. The government says passkeys now account for nearly one in ten daily One Login sign-ins.

The government says a passkey sign-in can be up to eight times faster than entering a username, password, and two-step verification code. It also estimates that passkey use is saving nearly £600 ($809) per day in SMS costs.

One Login connects people to a range of government services, including childcare support, tax services, and State Pension information.

The use of passkeys changes how GOV.UK One Login authenticates users who already have accounts.

When a user signs in, their device asks for a biometric scan or PIN to unlock the cryptographic credential registered for One Login. The service then verifies the resulting cryptographic response.

The government says the biometric information used to unlock a passkey is not shared with One Login or the services accessed through it.

This is separate from One Login’s identity checks, which can involve comparing a selfie with an identity document.

Users must first sign in and enter their password to create a passkey. The credential is then saved in a password manager, such as Apple Passwords or Google Password Manager.

The passkey can also be used on another device that shares the same password manager.

Passwords and security codes remain available as a fallback. Users can fall back to them if a passkey fails or they lose their device.

Singapore extended Singpass passkeys to Android users, after offering them to iPhone users. About 800,000 passkeys had been registered as of September 9.

Both implementations take different approaches to where credentials are kept.

Singpass uses a device-bound passkey model, with the private key stored on the user’s device, while GOV.UK One Login saves passkeys in a password manager and allows them to be used across devices sharing that manager.

The FIDO Alliance estimates that more than five billion passkeys are in use worldwide.

The expansion brings phishing-resistant passkey sign-in to an established government access platform.

Article Topics

biometric authentication  |  biometrics  |  Gov.UK  |  One Login  |  passkeys  |  passwordless authentication