HMRC sign-in: Government Gateway, One Login and passkeys explained

If you or your staff deal with HMRC online, you may have noticed that signing in is no longer one simple thing. Since February 2026 there are two ways in: the long-standing Government Gateway ID and the newer GOV.UK One Login. In September the government also widened passkey sign-in on One Login. None of this needs a panic, but it does reward a short, sensible tidy-up. Here is what has actually changed, what has not, and what a small business owner should do this week.

What HMRC changed in February 2026

HMRC announced on 10 February 2026 that new customers can register for its digital services with GOV.UK One Login. The change took effect on 9 February. Individuals who do not already have a Government Gateway account can create a One Login with just an email address and password, instead of a Government Gateway ID of 10 to 12 digits.

HMRC said this would make it simpler and quicker to use services such as filing a Self Assessment return or checking PAYE information. With HMRC added, more than 200 government services can now be reached through One Login, and the stated aim is for it to become the single way to use government services online. HMRC described the rollout for its customers as gradual and closely monitored.

What has not changed (yet)

This is the part that causes most confusion, so it is worth being precise. According to HMRC's own sign-in guidance on GOV.UK:

• If you already use HMRC online services, keep using the sign-in details you already have. That includes a Government Gateway user ID, even if you also hold One Login details from another government service.
• If you have never used HMRC online services, choose "Create new sign in details" when you sign in. The service then takes you through creating either Government Gateway or One Login details. HMRC says to do this even if you already have a One Login from elsewhere.
• The One Login option on that page is described as being for personal tax services.
• Some services use a separate sign-in process: excise, import and export services, the childcare account, and the Capital Gains Tax on UK property account.

In short, existing Government Gateway users do not need to do anything now. HMRC has said it will contact them when it is their turn to switch. The general GOV.UK guidance on One Login also says it does not yet work with every government account, and that over time it is intended to replace other sign-in methods on GOV.UK, including Government Gateway.

One quirk to know about: people who already have a One Login for another service, such as State Pension or Companies House, are told to keep using their Government Gateway ID for HMRC for now. Do not assume your existing One Login will simply work for HMRC.

Passkeys on One Login: useful, with caveats

In mid-September 2026 the government extended passkey sign-in across GOV.UK One Login, which serves more than 23 million people. A passkey lets you unlock your account with a fingerprint, face scan or device PIN rather than a password and a text message code. It is stored on your device, and the service holds only a public key, so a breach of the service cannot expose a usable login secret. Passkeys are also resistant to phishing because each one is tied to the site it was created for.

The government says more than 300,000 people used passkeys in the trial, that nearly one in ten daily One Login sign-ins already use one, and that this saves about £600 a day in text message costs. Those figures come from the government's announcement as reported by Privacy Guides, so treat them as the government's own numbers.

It is not a perfect picture, and a fair account should say so. Privacy Guides points out that you cannot sign up with a passkey: you create an account with a password first and add a passkey afterwards. The password cannot be removed once a passkey exists, and a "forgot my password" route can bypass the passkey. In practice that means a fake website could still trick someone into typing their password. A passkey is a real improvement, but it does not make the rest of your caution unnecessary.

What a small business should do this week

You do not need a project plan, just a short list.

• Find out who signs in. Make a note of which person holds each HMRC login: owner, bookkeeper, office manager. A login that only one person knows about is a risk the day that person is off or leaves.
• Do not change what works. If your Government Gateway ID works, leave it alone until HMRC contacts you. Do not create a second HMRC account "to be safe". HMRC tells people with existing details to keep using them.
• Do not share credentials. Each person should have their own sign-in. If an accountant or agent acts for you, use the proper authorisation routes rather than handing over your password.
• Use a password manager and a unique password. A One Login or Gateway password reused from another website is the weak point, passkey or not.
• Add a passkey if you use One Login for other government services. It takes a couple of minutes and removes the text message code from daily sign-in. Check your recovery email address is one you control and have secured with two-step verification.
• Keep your recovery details current. GOV.UK's One Login guidance says you can change your email address, password and how you receive security codes once signed in. Do it before you are locked out, not after.

Expect scammers to use the confusion

Any change to how people sign in is an opportunity for fake messages saying your account must be "verified" or "migrated" at once. HMRC has told existing Government Gateway users they will be contacted when it is their turn to switch, so a message that rushes you is a reason to slow down, not speed up. The safe habit is always the same: do not click the link in the message. Type the address into your browser or use the sign-in link on GOV.UK, and sign in from there. We have covered the warning signs before in our post on HMRC scam messages.

The same applies to staff. If someone in your team receives a "verify your One Login" message, they should know who to show it to before acting. A single sentence in your next team message is enough.

Why this matters beyond HMRC

For many firms, the bigger lesson is about your own customers. If the government can move millions of people to passkeys, it is reasonable to ask whether your own customers could benefit from the same simple sign-in on a website, booking system or app. If your business runs a customer account area, it is worth asking your developer whether passkeys or other modern sign-in options are on the roadmap. Our cloud and security work covers exactly this kind of review.

The short version

New individual HMRC customers can use One Login from 9 February 2026. Existing users keep their Government Gateway ID until HMRC says otherwise. Passkeys are now available across One Login and are worth switching on, with eyes open about their limits. Tidy up who holds which login, use unique passwords, and treat any message about "moving" your account with suspicion. Check HMRC's sign-in page on GOV.UK before you act on anything, as the details and timetable may change.