GOV.UK One Login opens passkeys to 23 million users, and is saving 600 pounds a day on SMS
After a 300,000-user trial, GOV.UK One Login is offering passkeys to more than 23 million people across childcare, driving licences, State Pension and tax services. Nearly one in ten daily sign-ins already use one. Passwords stay optional.
The UK government extended passkey support across GOV.UK One Login to more than 23 million users on September 14, 2026, after a trial with over 300,000. The services covered run from childcare support and driving licence renewals to State Pension checks and tax management. Users sign in with a fingerprint, Face ID, or device PIN instead of a password plus an SMS code, with the biometric or PIN staying on the device. The government says nearly one in ten daily One Login sign-ins already use a passkey, that they are up to eight times faster than password plus 2FA, and that the shift is already saving close to 600 pounds a day in SMS costs. Passwords remain available for anyone who prefers them.
Why it matters
This is the largest government passkey deployment to date and the numbers it published are more useful than the announcement. Eight times faster and 600 pounds a day in avoided SMS are the two figures that move a business case, and the SMS line is the one to steal: every organization still sending one-time codes is paying a per-message bill for its weakest factor. Amazon reported similar economics at 175 million users in August.
Read the "killing off passwords" framing carefully, though, because it is not what has happened. Passkeys are optional and passwords remain, which means One Login accounts keep a phishable recovery path. That matters more this week than most, given the BigBear kit that disables WebAuthn in the browser to force exactly such a fallback. A passkey alongside a live password is a faster login, not a phishing-resistant account.
That is not a criticism of the rollout so much as a description of where the hard part starts. At 23 million users spanning every level of digital confidence, removing the fallback means solving account recovery for people with one device and no backup, which is a genuinely unsolved problem at population scale. Watch what the UK does about recovery next; it will be the more instructive announcement.
Source: The Register
Related on Start with Identity
- BlogEntra ID makes passkeys the default, and retires SMS and voice in 2027
From September 2026 Entra ID auto-enables passkeys for users on SMS or voice. On 1 February 2027 those two methods stop working entirely, for every tenant, with
- BlogGoogle Workspace puts FIDO2 keys into the Windows login, days after Entra makes passkeys default
Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the defa
- BlogWhatsApp lets one account hold several passkeys, closing the cross-platform gap
Meta announced on August 25, 2026 that WhatsApp accounts can register multiple passkeys, so a user carrying both iOS and Android no longer has to bind to one ec
- ArticlePasswordless CIAM: Passkeys and WebAuthn for Customer Login
How to bring passwordless authentication to customer login: where passkeys fit, how they differ from magic links and OTP, the account-recovery problem, and a ro
- RecipeAdd login to a Next.js app with OIDC
A complete, copy-paste OpenID Connect login for the Next.js App Router using authorization code flow with PKCE, server-side token exchange, and httpOnly cookies
- RecipeAdd passkeys with WebAuthn
Implement passkey registration and authentication with the WebAuthn ceremonies: generate and verify challenges on the server, call navigator.credentials on the