Singpass passkeys reach Android, with about 800,000 already registered

Singapore's GovTech announced on September 9, 2026 that Singpass, the national digital identity used by 5.5 million people across more than 1,400 government and private-sector services, now supports passkey sign-in on Android. Android users who update to the latest Singpass app receive phased in-app prompts to create one. The rollout follows an iPhone beta that started this summer, and about 800,000 passkeys had been registered as of September 9. Users confirm sign-in with their device biometric or app passcode, and GovTech says passkeys only work on the genuine Singpass login domain. They are optional: QR code login, SMS one-time passwords and face verification all remain. Desktop support is planned by the end of 2026. Phishing was Singapore's second most common scam type in 2025, with S$39.9 million lost.

Why it matters

Singpass is a useful counterpoint to GOV.UK One Login: both are national schemes adding passkeys while keeping every older method alive. With SMS OTP still available, a determined phisher can steer a user to the weaker path, so the phishing benefit stays partial until fallbacks are retired or restricted to users without a passkey.

The recovery model is the detail to study. Setting up Singpass on a new phone automatically deactivates the app and passkey on the lost one, which ties account recovery to Singpass's own device re-enrollment rather than a cloud keychain. That gives the operator control over revocation, at the cost of making re-enrollment the security-critical step. Watch whether the desktop phase uses cross-device sign-in from the phone or a separate credential. See the Singapore digital ID profile for the wider scheme.

Source: Biometric Update via FIDO Alliance