Locked out of GOV.UK One Login

GOV.UK organises its One Login help by task — changing your sign in details, getting a security code, using a passkey — rather than by the failure you are actually experiencing. That is why people bounce between pages. Before you touch anything, establish which credentials you still hold, because the answer decides everything that follows and there is no single recovery button.

State one: you have your email address and your phone or authenticator app, but you cannot remember the password. This is the benign case. The 'I've forgotten my password' link on the sign-in page handles it, and GOV.UK's guidance confirms you will be sent security codes before you set a new one.

State two: you know your password and can reach your email, but the phone that receives your text codes is gone — lost, stolen, upgraded, or on a number you no longer control. There is a self-service route for this, but it carries a condition: GOV.UK states you can only change how you get security codes if you have already proved your identity with One Login.

State three: you know your password and can reach your email, but the authenticator app has gone with the handset. Mechanically this is the same route as state two, and it fails in the same place, but the recovery options on the device side are different and worth trying first.

State four: the registered email address itself is gone — a work address you lost when you left the job, a university address that expired, a mailbox someone else now controls. Changing the email address on a One Login requires you to sign in first, so if you cannot sign in there is no self-service route at all and you are heading for the support team.

There is also a fifth state that is not a lockout. If the sign-in page misbehaves, codes never arrive for anyone, or identity checking stalls, check the One Login status page before assuming the fault is yours. It publishes component-level status and past incidents, and you can subscribe to updates by email or SMS.

Start from the sign-in page you reached by typing the GOV.UK address, or from the government service you were actually trying to use. Select 'I've forgotten my password'. GOV.UK's guidance on changing your sign in details describes what happens next: you are sent security codes — to your email address, and to your phone or authenticator app — and only then are you allowed to create a new password.

That two-channel design is why this route is the easy one and also why it collapses so completely in the other three states. The reset is not a single email link. It is a demonstration that you still control both registered factors, so losing either one takes this route off the table.

Codes expire after 15 minutes. If you request more than one, only the most recent will work, which is the commonest reason a code that looks right is rejected. Type it rather than copying it, check you have not transposed digits, and if the window has passed, ask for a fresh one instead of retrying the old.

If a text code does not arrive, GOV.UK's security code guidance suggests sending it again or trying a different phone number, and points to poor reception or a blocked sender as likely causes. There is a harder limit worth knowing before you travel: you cannot receive a One Login code by text message on a phone number registered outside the UK. People discover this at an airport, which is the worst possible moment.

If an email code does not arrive, check the address is spelled as registered, look in spam and junk, and — if it is a work address — consider that your employer's mail filtering is holding it. GOV.UK's guidance explicitly suggests contacting your IT team or trying a different email address in that situation, which is a quiet acknowledgement that corporate mail filters break this routinely.

One thing not to ignore: if a security code arrives when you did not ask for one, somebody is attempting to sign in as you. GOV.UK's advice is to change your password immediately, and to consider setting up a passkey. Treat an unexpected code as an attempted account takeover rather than a glitch, and deal with the mailbox behind the account as well as the login itself.

First, check whether you set up a back-up method. GOV.UK's guidance on changing your sign in details says you can use a back-up — another phone number, or an authenticator app — if you added one previously. Most people did not, but it costs nothing to look, and if a back-up exists the whole problem evaporates in one screen.

Without a back-up, the route runs through the code screen itself. Start signing in as normal. When you are asked for the security code, select 'Problems with the code', then 'Check if you can change how you get security codes'. This is the option people miss entirely, because it is buried behind a link that reads like a troubleshooting page rather than a recovery route.

Here is the condition. GOV.UK states that you will only be able to change how you get security codes if you have already proved your identity with GOV.UK One Login. If you have, the system can re-anchor your second factor against the identity it already holds. If you have not, it has nothing to check you against, and the guidance directs you to use the GOV.UK One Login app to prove your identity before you can change the method.

If you are told you cannot change how you get security codes, that is the end of the self-service path and GOV.UK's own instruction is to contact One Login. Do not keep retrying: repeated failed attempts on any authentication system are counterproductive, and the support team is now the route rather than a last resort.

There is one more restriction that catches people who have moved abroad. Text message codes only work to a UK number, so emigrating, or switching to a foreign SIM long-term, silently disables the method even though nothing about the account has changed. An authenticator app has no such geography, which is the practical argument for switching to one before you go rather than after.

If the phone was stolen rather than mislaid, treat the One Login problem as the second job. The first is the handset and the accounts on it, because the same device very often carries your mailbox, your banking apps and the authenticator that guards everything else. Reporting the theft and blocking the handset comes before you start rebuilding logins.

This looks identical from One Login's side and behaves differently on yours. An authenticator app generates codes from a secret stored on the device when you first set it up. Replacing the handset does not carry that secret across unless the app itself syncs to an account you can still reach, or unless you restored the new phone from a backup of the old one. That is why people who moved to a new phone successfully find every app intact except the one that guards their government login.

Before you start any recovery, exhaust the device options. If the authenticator syncs to a cloud account, sign in to that account on the new device and let it restore. If you have an old handset in a drawer, charge it — the app will still generate valid codes even with no SIM and no service, because the codes are computed on the device rather than sent to it. If you took an encrypted device backup before the switch, restoring it can bring the secret back.

GOV.UK describes One Login's back-up options as another phone number or an authenticator app. It does not describe a set of printable one-time recovery codes of the kind some private services issue, so there is no sheet of emergency codes to dig out of a drawer. That absence is worth planning around: your back-up has to be a second live channel, not a piece of paper.

If the secret is genuinely gone, the recovery route is the same as for a lost phone. Start signing in, select 'Problems with the code' at the code screen, then 'Check if you can change how you get security codes'. The identity condition applies in exactly the same way, and a verified account can move itself to a text message method or a new authenticator while an unverified one cannot.

One useful detail from GOV.UK's guidance: an authenticator app does not have to live on a phone. Codes can be generated by an app on a smartphone, tablet or desktop computer. If your problem is that you keep losing or replacing phones, moving the authenticator to a machine that sits on a desk removes an entire class of failure.

Once you are back in, set up the second method the same day. The whole of this section exists because a single factor with no fallback is one dropped phone away from a support call, and the fix takes about ninety seconds from inside the account.

The email address is not merely a contact detail on a One Login. It is the account name, and it is the channel the password reset uses. That combination is what makes this the hardest of the four states: everything self-service assumes you can receive mail at that address.

If you can still sign in, fix it now rather than later. GOV.UK's guidance sets out the sequence: sign in, go to 'Security', select 'Manage your sign in details' under 'Sign in details', choose 'Change email address' next to 'Email', enter your password, enter the new address, and confirm with the security code sent to the new address. The password step is what stops somebody who has walked past your unlocked laptop from taking the account with them.

If you cannot sign in and the email address is unreachable, there is no route through the account. GOV.UK's instruction is to contact the One Login support team, and the realistic outcome is that they deal with the account rather than repair it. Where you cannot sign in, GOV.UK states the support team will need to delete the One Login, after which you create a new one from scratch.

Two situations behave differently from each other and get confused constantly. A lapsed address — a former employer's domain, a university account that expired, an internet provider you left — is simply dead, and the mail is unrecoverable. A compromised mailbox is a live account somebody else controls, and it is a security incident rather than an access problem. Recover or secure the mailbox first, because resetting your One Login while an attacker still holds the email address hands it straight back to them.

Work and study addresses are the recurring cause. A One Login created with an employer's address survives the job for exactly as long as the mailbox does, and GOV.UK's own security code guidance already flags corporate mail filtering as a reason codes go missing while you are still employed. The address that will still be yours in five years is the one worth registering.

If deletion and a fresh start becomes the answer, be clear about what you lose. GOV.UK states that deleting a One Login removes your sign in details, your identity information if you had proved your identity, the record of services you have accessed, any GOV.UK email subscriptions, and the ability to view or share documents you had added to the One Login app. It does not delete the personal information the services themselves hold about you — your tax record, your company filings and your applications all survive intact, because those live with the department, not with the login.

One Login separates two things that most accounts merge: the credential that gets you in, and the verified identity attached to it. GOV.UK explains that once you have proved your identity, that information is saved to your One Login and reused, so you do not repeat the check for every service. That reuse is the whole benefit, and it is also why losing a factor is treated as seriously as it is — a credential that carries a state-verified identity is a much bigger prize than a credential that does not.

The most common re-verification route is the GOV.UK One Login app. It requires an iPhone 8 or newer running iOS 16.7 or above, or a device running Android 10 or above, with a working camera. It checks three things: that your photo ID is genuine, that you are a real person, and that you are the person in the document. You photograph the ID, the app reads the biometric chip where the document has one, and you scan your face with the front camera.

The accepted documents are a UK passport, a non-UK passport with a biometric chip, a UK photocard driving licence, a UK biometric residence permit, a UK biometric residence card, or a UK Frontier Worker permit. Photocopies and digital images are not accepted. The expiry tolerances are unusually specific and worth checking before you give up: a passport cannot be expired at all, a DVLA photocard licence is accepted if it expired within the last 90 days, and a BRP, BRC or Frontier Worker permit is accepted if it expired within the last 24 months.

If the app cannot verify you, GOV.UK's guidance offers two things: try again with a different photo ID, or prove your identity another way. The browser route asks security questions drawn from records held about you — phone contracts, bank accounts, credit cards, loans, mortgages, or Personal Independence Payment — alongside details from a UK passport, a UK driving licence, or a current UK bank or building society account. It is the route that fails for people with a thin credit file rather than a missing document.

The in-person route runs through the Post Office. You enter your photo ID details on GOV.UK first and choose a branch, One Login emails you a customer letter to download, and you take that letter with the original document to the branch, where staff scan the ID and take your photograph. The Government Digital Service built it specifically for people who cannot use the app or the browser journey, including those without a smartphone, and it accepts a wider document range — non-chipped passports, EU driving licences and EEA national identity cards among them. Results usually come back within a day.

A cluster of app failures are not identity failures at all but linking failures. GOV.UK's guidance on linking the app is blunt about the causes: you must have started from an actual government service rather than opening the app cold, the browser must not be in private or incognito mode, and if you switch between the app and the browser you must return to the same browser you started in. If linking keeps failing, close every window and restart from the service.

GOV.UK One Login runs its own support team, and it is a real one with a phone number. Call 0300 373 9020 from the UK, or +44 208 629 0008 from abroad, Monday to Friday, 8am to 8pm UK time. Webchat runs on the same hours and starts with a digital assistant before you can reach a person. There is also a contact form, answered by email within two days, with the team working Monday to Friday, 9:30am to 5:30pm.

Have your reference code ready. One Login asks for it because it shows where in the journey you got stuck, and it is required on the phone route rather than optional. Note it down from the screen where the problem occurred before you close the window, because reconstructing what you were doing from memory wastes the first several minutes of the call.

Be clear with yourself about what support can and cannot do. GOV.UK does not describe a route by which the team simply lets you back in. Where you cannot sign in and the account has to go, GOV.UK states that the support team will need to delete the One Login. That is an outcome, not a failure — a deleted account and a fresh one you can verify is better than a live account you can never reach.

Then go to the service. This is the step people leave until last and should often take first, because One Login holds the key while the department holds the record, and a department with a deadline usually has a way to deal with you. HMRC's online services helpdesk is on 0300 200 3600, or +44 161 930 8445 from outside the UK, Monday to Friday 8am to 6pm. Note that HMRC's Government Gateway remains a separate system with its own rules: an account locked by repeated failed attempts unlocks automatically after two hours, and HMRC states its staff cannot unlock it manually. Where the problem is a One Login one, HMRC's own page redirects you to the One Login contact route.

The Disclosure and Barring Service takes One Login for basic checks and runs its own contact centre on 03000 200 190, or 03000 200 191 in Welsh, Monday to Friday 9am to 5pm, with Relay UK on 18001 then 03000 200 192 and British Sign Language support through the Convo app. If a basic DBS check is blocked by a login you cannot recover, they are the people who know what state your application is in.

Companies House is the clearest example of a service with a route around One Login entirely. Identity verification became a legal requirement on 18 November 2025 with a twelve-month transition, and Companies House states that anyone unable to verify through One Login can use an Authorised Corporate Service Provider — a regulated accountant, solicitor or formation agent — to carry out the check and submit it on your behalf for a fee. Where a filing deadline is closing and your One Login is not coming back in time, paying an ACSP is the mechanism that exists for exactly that situation.

Add a back-up method before you do anything else. GOV.UK's guidance describes back-ups as another phone number or an authenticator app, set from 'Security', then 'Manage your sign in details', then 'How you get security codes to sign in'. One factor with no fallback is what turned a dropped phone into everything you have just been through.

Set up a passkey. GOV.UK describes it as a way to sign in faster without a password or a security code, using a face or fingerprint scan or your device passcode, PIN or pattern. It works on an iPhone 8 or newer on iOS 16 or above, an iPad on iOS 16 or above, Android 10 or above, Windows 10 or above and macOS Ventura 13 or above, and the device must already have a screen lock. The passkey is stored in your device's password manager when you create it.

Understand what a passkey does and does not remove. GOV.UK is explicit that there may still be times when you need your password and a security code, for example as a back-up if you lose the passkey. It is an additional door rather than a replacement lock. GOV.UK also draws a line between a device that is lost and one that is stolen: if it is lost, you can still sign in with the passkey on another device or with your password and a security code, but if it is stolen you should remove the passkey from your account and set up a new one.

Register the email address you will still have in five years. A One Login built on an employer's or a university's mailbox is a lockout with a delayed fuse, and it detonates the day your access ends rather than the day you notice.

Learn the phishing shape, because a compromised One Login is a far worse day than a locked one. Government services do not send sign-in links, so a message asking you to verify urgently, warning that your account will close, or offering a payment is fraudulent regardless of how it looks. The National Cyber Security Centre asks you to forward suspicious emails to [email protected] and to report scam websites through its reporting form. Suspicious texts go to 7726, free on every UK network.

If you have actually lost money or handed credentials to a fake site, that is fraud rather than a support query. The NCSC directs victims in England, Wales and Northern Ireland to Action Fraud on 0300 123 2040 or through reportfraud.police.uk, and victims in Scotland to Police Scotland on 101. Report the phishing to the NCSC as well, so the site can be taken down for the next person.

Finally, if you are helping somebody else through any of this, do it within the rules. GOV.UK permits you to help someone create a One Login and prove their identity — lending a device, helping download the app, steadying a phone during an ID scan — but says you must avoid entering information on their behalf, including choosing their password, entering their security codes or answering their security questions, and you must not look over their shoulder during a face scan. Only the person themselves should be able to sign in, and each person needs their own email address and phone number. Sharing an account is not a shortcut; it is the thing that makes the next recovery impossible.