Passkey protects your account through three key safeguards:

1. Domain protection

Your unique passkey cannot be used on fake websites and will only work with Singpass logins (singpass.gov.sg) on real government websites and private sector services integrated with Singpass, protecting you from phishing scams.

2. Device protection

Your unique passkey is stored in your Singpass app and is protected by your device’s built-in security hardware. Your passkey never leaves your phone, so attackers cannot copy or reuse your passkey.

3. Proximity protection

Your device with the unique passkey must be nearby to confirm the login through a proximity check via Bluetooth. This adds an extra layer of security by ensuring you are physically present.

These safeguards work together to significantly reduce the risk of phishing scams and unauthorised access to your Singpass account.