UK.gov begins killing off passwords for 23 million users

The UK is expanding passkey access across GOV.UK One Login to more than 23 million users after a 300,000-user trial, with passkeys already representing nearly 10% of daily sign-ins. The government says passkeys are up to eight times faster than password-plus-2FA authentication and are saving nearly £600 per day in SMS costs. The rollout is intended to reduce phishing and fraud risk while improving access to government services; passwords remain optional.

Analysis

This is a modest but credible validation event for passwordless authentication rather than a near-term revenue catalyst. Government deployment lowers procurement and adoption friction for enterprise identity platforms, particularly where regulated customers need phishing-resistant MFA; the bigger economic value is avoided account-takeover loss and help-desk resets, not SMS savings. Likely beneficiaries are identity vendors with passkey/FIDO2 support and public-sector distribution—Okta (OKTA), CyberArk (CYBR), Microsoft (MSFT)—while SMS-centric authentication vendors face a gradual erosion of low-value OTP volumes.

The 1-3 month market effect should be negligible because optional adoption and a single government tenant do not alter earnings estimates. Over 6-18 months, however, successful migration can create a reference architecture for UK banks, insurers and utilities, where fraud reimbursement, regulatory scrutiny and customer-abandonment rates make passwordless conversion economically material. The second-order implication is that device-bound credentials increase switching costs around operating-system and identity ecosystems, favoring MSFT, Apple (AAPL) and Alphabet (GOOGL) more than standalone biometric hardware suppliers.

Consensus may overstate disruption to communications-platform-as-a-service vendors: SMS remains necessary for recovery flows, un-enrolled users and cross-device edge cases, and authentication traffic is only one component of Twilio's (TWLO) revenue base. The signal becomes investable only if adoption persists beyond early adopters and procurement expands across agencies; monitor UK digital identity mandates, published fraud-loss metrics and enterprise passkey penetration rather than headline user eligibility.

Key Decisions for Investors

• No immediate directional trade: impact is too small to change FY estimates for OKTA, CYBR, MSFT or TWLO; place a 6-12 month watch on UK public-sector identity tenders and evidence of mandatory phishing-resistant MFA.
• Prefer MSFT over TWLO in a 6-18 month thematic pair if passkey adoption broadens across regulated enterprises: MSFT monetizes identity through bundled Entra attach rates and platform lock-in, while OTP pricing/volume faces secular pressure. Size only after confirming sustained adoption above early-pilot levels; invalidate if SMS recovery demand offsets OTP displacement or Twilio shows authentication revenue acceleration.
• Maintain selective long bias to CYBR/OKTA on material multiple pullbacks, not on this event. A tradable catalyst would be enterprise guidance explicitly citing passwordless-seat growth, lower support costs, or public-sector contract wins; absent those disclosures, treat the news as sector validation rather than an earnings catalyst.