America.gov Will Take First-Time Passport Applications Online. The Identity Problem Isn't Solved Yet

Starting in 2027, Americans will be able to apply for their first passport entirely online through America.gov, signing in with Login.gov. Secretary of State Marco Rubio announced it at the America.gov launch on September 29, 2026. Today a first passport requires an in-person visit. Moving it online turns a remote identity check into the front door for America's most trusted identity document, and the State Department has not yet said how that check will work.

Key facts

• What was announced: "Starting next year, Americans will be able to apply for their first passport entirely online," Rubio said in his September 29 remarks. The stated goal is for "the vast majority of Americans" to be able to apply for a passport or passport card on America.gov by the end of 2027.
• How it works in the demo: sign in with Login.gov, see information the government already holds, take or upload a photo, pay, and track delivery.
• Who verifies you: Login.gov. Executive Order 14432, signed the same day, directs GSA to use "Login.gov as the authentication service for America.gov."
• What is still unknown: eligibility rules, the identity verification level required, and how proof of citizenship is checked remotely. Yahoo reports that full rules have not been released.
• Privacy paperwork: GSA's privacy impact assessment index lists a Login.gov assessment revised October 21, 2026, but no separate one for America.gov, as of November 3.

What Rubio actually promised

Rubio's pitch was blunt. "No printing forms, no drugstore hostage photo," he said, "no appointment, no line, no middleman". In the demo, once signed in through Login.gov, "I can securely see the information that the government already has about me in its system." The photo is taken on a phone and previewed in the finished passport. The checkout is prefilled from Login.gov.

Some early coverage said applications would open in December 2026. The transcript says "starting next year." I am treating 2027 as the start date until the State Department says otherwise.

For anyone who has stood in line with a folder of documents, this sounds wonderful. The design also has real strengths, which I will come to. But one detail matters more than the rest.

A first-time passport application is the moment the government decides, for the first time, that you are who you say you are and that you are a citizen. Today that decision is made face to face. Soon it will be made remotely.

That is not a reason to stop. It is a reason to get the identity layer right before launch, and to tell the public how it works. I explained the platform itself in America.gov explained; this piece is about the identity problem underneath it.

Why the first passport is different

Most government services verify an identity that already exists somewhere. Renewing a passport, checking benefits or changing an address all start from a record the government already trusts.

A first passport is different. It is often the root document that later identity checks rely on. Rubio himself called the passport "the most trusted and powerful" identity document in the world. If a criminal obtains a genuine passport in someone else's name, every system that trusts passports inherits the fraud.

That is why first-time applicants have had to appear in person with original proof of citizenship and identity. The in-person step is slow and inconvenient. It is also a fraud control. Moving it online does not remove the need for that control. It moves the control into software.

What we know about the design

From Rubio's remarks and the text of Executive Order 14432:

• Login.gov is the front door. The order directs GSA to integrate Login.gov with America.gov and requires agencies to complete Login.gov integration consistent with OMB Memorandum M-26-18.
• Agencies keep their records and decisions. The order's policy is to "preserve each agency's custody and control of its records, systems, statutory responsibilities, and adjudicatory authority." It says unified access "does not create a centralized Federal system of records concerning the American people."
• Data minimization is in the text. The order lists it among the protections for personal information.
• Old channels stay open. In-person, telephone, mail and agency-specific methods are preserved, so America.gov "does not become the only option."

Those points deserve credit. A front end that routes requests while the State Department still makes the decision is the right architecture. So is refusing to build one database of everything about every American. The question is execution.

How Login.gov verifies identity today

Login.gov's developer documentation defines the levels an agency can request. Its help pages describe what users go through.

Level	What it checks	Meets NIST IAL2?
Authentication only	Email, password and at least one MFA method. No identity verification.	No
Basic identity verification	Photos of your ID, SSN and personal details checked "against public and proprietary records," phone or mail address check. No facial matching.	No (meets IAL1)
Verification with facial match	Everything in basic, plus a selfie compared with your ID photo.	Yes
In person	Personal details verified online first, then your driver's license or state ID checked at a participating Post Office.	Not stated on the help page

IAL2 is NIST's identity assurance level for cases where the stakes are significant. A first passport is about as significant as identity proofing gets.

The updated Login.gov privacy impact assessment, signed October 21, 2026, adds detail. It names AAMVA, the Department of State, LexisNexis and Socure as verification services. It says the vendors use AI for face matching, liveness detection and risk scoring. It also confirms that photo-based verification is certified at IAL2.

Seven questions the State Department should answer before launch

1. Which identity level will first-time applicants need?

Basic Login.gov verification has no facial matching and does not meet IAL2. For a first passport, verification with facial match or in person should be the minimum. The State Department has not said which it will require.

2. How will proof of citizenship be verified remotely?

Today, applicants hand over an original birth certificate or other citizenship evidence. A phone photo of a birth certificate is far easier to fake than the paper original. My view is that electronic checks against state vital records beat document images. The public deserves to know which method is used.

3. How will selfie checks resist deepfakes?

Remote face matching now faces deepfake video and injection attacks, where fake imagery is fed straight into the camera stream. The Login.gov assessment says its vendors run liveness detection. For passport issuance, that liveness and injection resistance should be tested independently, and the results summarized publicly.

4. How will accounts be protected after sign-up?

Once a Login.gov account can start a passport application, taking over that account becomes valuable. Login.gov already supports face or touch unlock and security keys alongside text-message codes. Phishing-resistant methods should be required, or at least strongly defaulted, for passport actions. Attackers already target the enrollment step itself, as the passkey enrollment attacks on Microsoft accounts show.

5. How will stolen identity data be detected?

Basic verification matches name, date of birth, address and SSN. Criminals often have all four. SpyCloud's 2026 Identity Exposure Report counted 65.7 billion distinct identity records in its recaptured data, up 23% in a year. I covered how infostealers feed that supply in 24 billion stolen credentials in one database. Fraud signals beyond data matching, such as device reputation and velocity checks across applications, are essential.

6. Will a privacy impact assessment for America.gov be published before launch?

Biometric Update reported on October 1 that a September Login.gov code change added a browser identifier stored in a cookie with a 20-year lifetime and attached to analytics events. The public GitHub issue raising it is still open as of November 3. GSA's index now has a revised Login.gov assessment, but no separate one for America.gov. Passport applications involve some of the most sensitive data the government holds. A specific assessment should be public before the first application is accepted.

7. How will the public know what is real?

The passport impersonation business already exists, and Rubio named it on stage: sites "charging you for forms that are free". On October 22, the FTC sued GovAssist and related companies, alleging they used paid Google search ads to pose as passport services and delivered forms available free. These are allegations, not findings. A heavily promoted new government front door is exactly what impersonators will copy. The government impersonation scams in Scam Atlas show the playbooks they already use.

What applicants should do

If you plan to apply for a first passport through America.gov:

1. Type the address yourself. Use america.gov, login.gov and travel.state.gov only. Do not click ads or links in texts and emails.
2. Secure Login.gov with face or touch unlock or a security key rather than text-message codes.
3. Expect to verify your face. If remote verification fails or you are uncomfortable with it, Login.gov offers in-person verification at participating Post Offices.
4. Never pay a third party to "help" you apply. Pay official fees only inside the official application.
5. Check status only on the official site. If you get a message about your application that you did not expect, go to the site directly rather than replying.

My read (analysis)

America.gov's passport plan is a good idea with a high bar.

The good: a federated design, agencies keeping their own records and decisions, paper and in-person channels preserved, and a plain-language front door that could save millions of people hours of confusion. Those are the right instincts.

The bar: the first passport is the root of identity for everything after it. Remote proofing can meet that bar, and banks already onboard customers remotely at high assurance. It only works with facial match and liveness at the strongest level, phishing-resistant sign-in, fraud detection beyond data matching, and transparency about how it all works.

If the State Department answers these seven questions before launch, public trust will follow. If the system launches first and explains later, the first major fraud story will define it.

FAQ

Can I apply for my first US passport online?

Not yet. Secretary of State Marco Rubio said on September 29, 2026 that first-time online applications through America.gov start in 2027. The goal is for most Americans to be able to apply online by the end of 2027. Until then, first-time applicants apply in person.

Will I need Login.gov to apply for a passport on America.gov?

Yes, in the process Rubio demonstrated, applicants sign in with Login.gov. Executive Order 14432 makes Login.gov the authentication service for America.gov. Paper, mail and in-person channels must remain available.

How does Login.gov verify identity?

Basic verification checks photos of your ID, your SSN and personal details against records, and your phone or address. It does not meet NIST IAL2. Verification with a selfie matched to your ID meets IAL2. You can also finish verification at a participating Post Office.

How do I avoid passport scam websites?

Type america.gov, login.gov or travel.state.gov yourself and ignore search ads. Never pay a third party to fill in forms that are free from the State Department. In October 2026 the FTC sued companies it alleges posed as passport services through paid search ads.