Innovation in Citizen Services
Switch to passkeys for safer logins
27 July 2026
5 things to know about passkeys, a secure password-free login method that protects you against phishing scams.
.png)
You get an email stating that your account requires verification. You click the link, land on what looks like a Singpass login page and key in your details. By the time you realised the site was fake, it is too late.
This scenario is more common than you think as phishing scams were the second most common type of scam in Singapore in 2025, with losses amounting to S$39.9 million. And as scam tactics grow more sophisticated, staying protected requires more than just being careful, but also the right tools and support.
The stakes are high when it comes to Singpass, Singapore’s national digital identity platform that facilitates over 41 million transactions monthly, across thousands of government and private sectors services, including finance and healthcare. With the wide breadth of services accessible through a Singpass login, a compromised account may result in severe consequences for users.
Earlier this month, Singpass rolled out passkeys, a new and safer way to log in that’s significantly more resistant to phishing scams. The feature is currently in beta for iPhone (iOS) users on mobile browsers, and it will be extended to Android users and for desktop login in subsequent phases. Users who have enabled notifications in their settings will receive a push notification in the Singpass app when the feature becomes available to them.
What are passkeys?
Passkeys are a secure, password-free way to log in to services with Singpass. They are phishing resistant and use device-based authentication such as facial recognition, fingerprint, or app passcode to verify your identity.
If you haven’t tried it yet, here are five key things to know, and why it may be worth switching.
1. It’s password‑free and more seamless
Passkeys let you log in without passwords or SMS One-Time Passwords (OTP). Instead, you use facial recognition, fingerprint, or your app passcode to authenticate.
This removes one of the biggest weaknesses in online security: passwords that can be reused, stolen, or tricked out of users through social engineering.
What this means for you: Fewer steps at login, and no password to remember or accidentally reveal.
2. Passkeys protect you from fake websites
Phishing scams often rely on look‑alike websites that trick users into typing in their Singpass credentials.
Passkeys only work on the real Singpass login domain, which means they cannot be used on fake websites, even if the page looks convincing. During login, you do not enter any credentials, so there is nothing to steal.
For added protection, cross-device logins require a Bluetooth proximity check to ensure that the passkey is only being used for authentication on a nearby device, blocking remote attacks from elsewhere.
What this means for you: Even if you tap on a suspicious link by mistake, passkeys help stop the scam before it succeeds.
3. Your passkey stays securely on your device
When you create a passkey, your device generates a pair of cryptographic keys. Importantly, the private key never leaves your device and is protected by your device biometrics or PIN.
The corresponding public key is registered with Singpass, and it cannot be used on its own to access your account. During login, the public key is verified against the public key to validate an official Singpass login.
If your phone is lost or replaced, call the Singpass Helpdesk to secure your account. Your Singpass app and passkey are also automatically deactivated on the lost device once you set up the Singpass app on a new device.
What this means for you: Stronger protection without having to manage anything manually after creating your passkey.
4. Existing login methods remain available
Passkeys are an additional login option, and do not replace existing methods like QR login, Face Verification, or SMS OTP.
What this means for you: Flexibility. You can start using passkeys but also have the fallback of your familiar login methods.
5. Setting it up takes just a few taps
Creating a passkey is quick and happens entirely within the Singpass app:
Open the Singpass app and tap the “Create passkey” banner
Follow the on‑screen prompts to confirm with your biometrics or passcode
That’s it, try using your passkey the next time you log in!
What this means for you: No forms to fill or extra apps to download.
Ready to try it?
Learn more about Singpass passkey
For assistance, contact the Singpass Helpdesk or visit a ServiceSG or Singpass counter located in Community Centres or Clubs across Singapore. Feedback is welcomed via the contact form on the Singpass website or within the Singpass app settings, as part of ongoing efforts to enhance the Singpass service.
What’s next
For GovTech Singapore, passkeys are more than a new feature. As Singapore’s digital economy grows and cyber threats become more sophisticated, strengthening the security of our national digital identity platform remains critical. Passkeys are part of our commitment to build a Singpass that is secure, inclusive, and gives users greater peace of mind when transacting online.