UK government says goodbye to passwords and expands passkey access to 23 million

From now on, UK citizens can log in to online government services using passkeys instead of a username and password.

As of Monday, passkeys are being rolled out across GOV.UK One Login, allowing over 23 million users a way to log in more securely to government services, such as applying for childcare services and renewing their driver’s license.

During the initial trial, more than 300,000 users successfully switched to passkeys. One in ten GOV.UK One Login sign-ins are now being done using passkeys, allegedly saving British taxpayers approximately £600 per day in text message costs.

“Nobody enjoys hunting for a forgotten password or waiting for a text message code just to check their tax return or renew a document. Passkeys mean people can access the services they rely on in seconds, using the same fingerprint or face scan they already use to unlock their phone,” Stephanie Peacock, Minister for the Department for Digital, Culture, Media and Sport, says in a statement.

Passkeys are an authentication method based on technology called Web Authentication (WebAuthn). This allows providers of social media platforms and other online services to build strong authentication into their services by using registered customer devices, such as smartphones or laptops.

Passkeys are based on the principles of asymmetric cryptography, which involves two distinct sets of keys. The public key is stored on the website providing a service, and the private key is kept on a user’s personal device. If both keys match, their identity is verified, and they’ll gain access to their account.

Passkeys aren’t based on the transmission of a fixed, static value, such as a password, but rather on a challenge-response process in which users cryptographically sign a message with a complex, randomly generated one-time value transmitted by the other party. Furthermore, passkeys can’t be intercepted, reused, or stolen. That makes them safer than passwords.

The use of passkeys to log in to GOV.UK One Login is not required, but is recommended by the National Cyber Security Centre (NCSC) as more secure and easier to use than passwords.

“We strongly encourage users to set up a passkey for GOV.UK One Login and to do so wherever passkeys are available across digital services. By taking this small but significant step, you can help protect your online accounts and raise our collective resilience, making the UK safer,” Jonathon Ellison, NCSC Director for National Resilience, states.

However, users can also continue to log in using their username and password.