What Was Announced
On 14 September, the Department for Digital, Culture, Media and Sport and the Government Digital Service announced that passkeys are being rolled out across GOV.UK One Login, the single sign-in used for services such as checking a State Pension, managing tax, accessing childcare support and renewing a driving licence. More than 23 million users can now set one up, following a trial in which more than 300,000 people made the switch.
A passkey lets a user sign in with a fingerprint, Face ID or device PIN instead of a password and a two-step code. The government says the biometric or PIN stays on the user's device and is never seen or stored by One Login. It also says passkey sign-in is up to eight times faster than the password-plus-code route.
Two figures are worth reading closely. Nearly one in ten daily One Login sign-ins already use a passkey. And the switch is saving the government nearly £600 a day in SMS costs, which is the kind of number that gets a programme funded. The Register points out that whether 23 million users share Whitehall's enthusiasm is still unclear, and that passkeys are optional, so passwords are not going away yet.
The Security Case, and Where It Stops
The mechanism is why the NCSC's Jonathon Ellison calls passkeys a highly phishing-resistant alternative. A passkey is a key pair created for one specific service. The private key stays on the user's device or in their credential manager, and the service only receives proof that the right key signed a challenge. Because the credential is bound to the site it was created for, a convincing fake login page has nothing to harvest and nothing to relay, since the browser will not offer the passkey to the wrong origin. And because the server holds only public keys, a breach of the service does not leak a reusable secret.
Now the limit. While passwords remain optional, the weakest sign-in method an account still accepts sets its real security level. An attacker does not need to defeat a passkey if the same account will take a password and a text code, and phishing kits are very good at relaying exactly that. People who adopt passkeys are well protected. Accounts that have not, and accounts that keep every legacy option switched on, are largely where they were.
That is a reasonable trade-off at launch for a service of this size. It also means the "one in ten sign-ins" figure measures usage, not exposure. Identity teams running their own programmes should track both: the share of sign-ins that use a passkey, and the share of accounts where the password and SMS routes have actually been removed.
The Hard Part Is Everything Around the Passkey
Neither the government's announcement nor The Register's coverage says much about recovery, and that is where programmes like this are won or lost. What happens when a user loses their phone, has only one device and no backup, or cannot use biometrics? Whatever recovery path exists becomes the new attack surface, because attackers go where the strongest control is not. A passkey that is hard to phish is little use if a convincing call to a help desk can reset it.
The device model matters too. Some passkeys stay on a single device, while others sync through a platform credential manager, and each has different consequences for recovery, shared devices, family phones and assistive technology. The government's description of passkeys as tied to a device and a website is a fair simplification for a public announcement. An identity team has to design for both cases.
Then there is the cost side. The SMS saving is real and published. The offsetting cost of recovery and support is not in the announcement, and it is worth modelling before you quote anyone else's numbers in your own business case.
What Identity Teams Can Take From It
1. Build the case on measured cost
SMS spend, help desk resets and sign-in time are all numbers you can collect before you start. The UK's published figures landed because they were concrete. Yours can be too.
2. Treat "optional" as a stage, not an end state
Offer, then nudge, then retire. Decide in advance what moves you from one stage to the next, whether that is an adoption threshold, a risk signal, or removing SMS for users who already hold a passkey.
3. Do not leave a passkey sitting beside the weakest factor forever
Once an account has a passkey, consider removing the password and SMS routes for it, or at least require the passkey for sensitive actions. Otherwise the attacker simply uses the door that is still open.
4. Design recovery before you scale
Encourage users to register more than one passkey, make recovery as strong as the sign-in it replaces, and monitor recovery events as closely as logins. This is the step that most often gets deferred and most often gets exploited.
5. Measure exposure, not just usage
Track the share of sign-ins by method, the share of accounts with legacy factors removed, and recovery volume. Together they tell you whether the programme is making you safer or only faster.
The Trevonix Perspective
At Trevonix, we find the GOV.UK story useful for a reason other than the headline. Passkeys work, and that is no longer in doubt. What is instructive is that a government serving 23 million users chose to start optional and to publish its numbers. That sequencing question sits in front of most organisations moving to passkeys, whether the users are customers, partners or staff.
For customer and partner identity, the questions are adoption, fallback and recovery at scale. For workforce access and authentication, the same decisions come with stricter expectations, because the weakest remaining factor is exactly what an attacker will look for. Getting the order right is a strategy question as much as a technology one, which is where IAM strategy and advisory work earns its keep.
Key Takeaways
- GOV.UK One Login is rolling out optional passkeys to more than 23 million users after a trial of more than 300,000.
- Nearly one in ten daily sign-ins already use a passkey, and the government reports a saving of nearly £600 a day in SMS costs.
- Passkeys resist phishing because the credential is bound to the legitimate service, but while passwords stay available the weakest enabled method sets the real security level.
- Recovery, device model and support cost are where large passkey programmes succeed or stall.
- Measure exposure as well as usage, and plan how optional becomes the default.
Source Credits: GOV.UK, The Register
