How Singpass Passkeys Work—and Who Can Use Them

Singpass’s passkey feature is a new, optional way to sign in without entering a password, SMS one-time password or QR approval. The beta opened on 1 July 2026 for iPhone users on mobile browsers, with Android and desktop support planned for later phases.

The important distinction is that a passkey does not merely add another secret for a scammer to steal. It uses a device-bound cryptographic credential that is tied to the legitimate Singpass login service, making it substantially more resistant to phishing.

What Singpass passkeys replace

Traditional login methods can expose reusable information. A password can be copied, an OTP can be relayed and a QR code can be manipulated into approving a login initiated by someone else. Passkeys change the exchange so that no password or OTP is entered or transmitted during authentication.

The user still proves control of the device locally, usually with biometrics or a passcode, but the website does not receive the biometric data or the private key. It receives a cryptographic response that can be checked but not reused as a password.

How the public-private key pair works

During registration, the iPhone generates a unique public-private key pair:

• The private key stays on the registered device and is used to produce a digital signature.
• The corresponding public key is registered with Singpass and is used to verify that signature.
• Singpass sends a fresh challenge during login.
• The phone signs that challenge only after the user authorises the action with Face ID, Touch ID or the Singpass app passcode.
• Singpass verifies the response with the stored public key.

This is more accurately an authentication use of public-key cryptography than a simple “encryption key exchange.” The private key is not sent to Singpass, while the public key alone cannot be used to impersonate the user. FIDO standards describe this model as origin-bound authentication: the credential is associated with the legitimate service domain, so a look-alike website cannot obtain a response that works for Singpass.

That is why a copied Singpass login page has much less value against a passkey user. There is no reusable password, OTP or QR approval for the fake site to collect and replay.

Who can use Singpass passkeys at launch?

The initial beta rollout is limited:

• iPhone and iOS users: supported from 1 July 2026 through mobile browsers.
• Android users: support is planned for a subsequent phase.
• Laptops and desktops: desktop browser login was also deferred to a later phase.

This staged approach means an iPhone user can use the passkey on a supported mobile-browser login, but users should not assume that every Singpass service or every device will offer the option immediately.

How to register a Singpass passkey

For the initial iPhone rollout, the registration process is handled in the Singpass mobile app:

1. Update the Singpass app to its latest version.
2. Open the app and select the passkey banner on the home screen.
3. Follow the on-screen instructions to create the passkey.

Once registered, users authenticate locally with Face ID, Touch ID or fingerprint, or the Singpass six-digit app passcode, depending on the device and available settings. The user does not type a Singpass password into the participating website.

Why Bluetooth proximity matters for cross-device login

A separate-device scenario creates a different risk: someone might try to persuade a victim to approve a login taking place on a scammer-controlled computer or phone. For cross-device authentication, Singpass can use a short-range Bluetooth check to confirm that the registered phone is physically near the device requesting the login.

The proximity check does not replace the key-pair verification. It adds evidence that the phone holding the passkey is nearby. That makes a purely remote approval flow harder for a scammer to orchestrate—for example, by sending a victim a QR code and coaching them through an approval while the scammer operates elsewhere.

Why passwords, QR codes and other methods remain available

Passkeys are an additional login method during the beta, not an immediate universal replacement. Existing options remain necessary for people without an eligible iPhone, users who have not enrolled, and services or devices that are not yet included in the staged rollout.

Those older methods are still useful for accessibility and coverage, but their security depends more heavily on user behaviour. A person can be manipulated into disclosing a password or OTP, scanning a fraudulent QR code or approving an unexpected request. Singapore Police continue to warn the public never to share Singpass passwords or 2FA details with unknown people.

Passkeys reduce the amount of credential material that can be phished; they do not eliminate every scam tactic. A scammer can still impersonate an organisation, pressure someone into revealing personal information or attempt to exploit a recovery or account-takeover process.

How the feature relates to FIDO standards

Singpass’s design follows the public-key, origin-bound model associated with FIDO and WebAuthn. FIDO2 is an open authentication standard intended to provide phishing-resistant cryptographic credentials rather than proprietary, reusable secrets.

The standards approach matters because passkeys are designed for interoperability across the broader authentication ecosystem. The FIDO Alliance describes passkeys as credentials tied to an account on a website or application and usable with a phone, computer or hardware security key, subject to the implementation and rollout supported by each service.

For Singpass, the practical security benefit is domain binding: the authenticator is expected to respond for the legitimate service, not for a visually similar phishing domain.

The scam figures behind the change

Singapore recorded 37,308 scam cases and approximately S$913.1 million in scam losses in 2025. Those totals cover scams overall, not phishing alone.

The official annual figures reported through Singapore scam-information channels separately list 6,264 phishing cases and S$39.9 million lost to phishing in 2025. That makes phishing a significant part of the wider scam problem, but the figures should not be treated as evidence that all scam losses involved stolen Singpass credentials.

The product decision is therefore targeted: passkeys are designed to make the credential-capture stage of phishing far less useful. Users still need to verify websites, reject unexpected login requests and avoid sharing Singpass details, especially while older authentication methods remain available.