Skip to main content

Does the course platform have access to my WA.gov password?

Updated

Quick answer

No. The course platform never sees, receives, or stores your WA.gov password.

When you sign in, you type your password on WA.gov — not on the course. WA.gov checks it and tells the course, “Yes, this is the right person.” That confirmation is the only thing the course gets back.

In this article

  • How sign-in works behind the scenes
  • Who sees what during sign-in
  • How to spot a fake login page
  • What to do if you think your password is compromised

How sign-in works behind the scenes

The course uses the state of Washington’s single sign-on (SSO) system. SSO means you use one trusted account, managed by WA.gov, to access many state services. Here’s what happens when you sign in:

  1. You click Sign in on the course. The course sends you to the WA.gov sign-in page.
  2. You enter your WA.gov username and password directly on the WA.gov page. The course is not part of this step. If you don't have an account, you will asked to create one.
  3. If you have multi-factor authentication on, WA.gov also asks you for a code. The course is still not part of this step.
  4. WA.gov confirms your identity and sends a signed token back to the course. This token says, in effect, “We checked, and this is a valid user.” It does not contain your password.
  5. The course reads the token and signs you in. You can now start the course.

This is sometimes called federated authentication, and it’s the same pattern used when you “Sign in with Google” or “Sign in with Apple” on other websites. The advantage is that your password only ever lives in one place — with the identity provider you already trust.

Who sees what during sign-in

Use this table to see exactly where each piece of information stays.

Information WA.gov Course platform (LMS)
Your WA.gov username Yes — used to identify you. Receives only a confirmation that this user is signed in.
Your WA.gov password Yes — checked by WA.gov when you sign in. Never. The course platform never sees, receives, or stores it.
Multi-factor authentication codes (if enabled) Yes — verified by WA.gov. Never. These stay with WA.gov.
Your Driver License Number, last name, date of birth No — WA.gov does not collect these for the course. Yes — you enter these directly in the course after signing in, so we can verify your identity with DRIVES.

Standards behind the scenes

The course platform uses industry-standard SAML 2.0 and OpenID Connect to communicate with WA.gov. These protocols are designed so the course only ever receives a signed assertion of identity, not your credentials.

How to spot a fake login page

Because so many state services use WA.gov, scammers sometimes set up look-alike pages to steal credentials. A few checks help you stay safe:

  • Check the address bar. TLook for the lock icon, and make sure the domain ends in “.wa.gov” Watch out for tricky spellings like “wa-gov.com” or “wa.gov-secure.net.”
  • Start from a trusted link. Open the course from https://washington-dol.mydrivingcourses.com or the DOL website. Don’t sign in by clicking links in text messages, social media, or emails you weren’t expecting.
  • WA.gov will never ask for your Driver License Number, date of birth, or Social Security Number on the sign-in page. If a page that looks like WA.gov asks for any of those, it isn’t WA.gov.
  • Support and DOL will never call, text, or email you and ask for your WA.gov password. If anyone asks, do not share it.

⚠ If you’re ever unsure

Close the suspicious page. If you’ve already entered your password on a page you don’t trust, follow the “What to do if you think your password is compromised” steps below right away.

[ FIGURE PLACEHOLDER ]

Figure 2 — Anatomy of the real WA.gov sign-in page. Annotated screenshot of WA.gov highlighting the URL bar, the padlock icon, and the official Washington State branding.

What to do if you think your password is compromised

If you accidentally entered your WA.gov password on a page you don’t trust, or you think someone else may know it, take these steps as soon as possible:

  1. Open a new browser window and go directly to WA.gov (don’t click a link from an email).
  2. Sign in and change your password. Use a strong, unique password you don’t use anywhere else.
  3. Turn on multi-factor authentication if it isn’t already on.
  4. Sign in to the course and check your My Courses status to make sure nothing looks out of place.
  5. If you see activity on your course that wasn’t you (for example, lessons completed you didn’t take), report it to support.

Tip: Use a password manager

A password manager is a free tool built into most modern browsers and phones. It creates strong, unique passwords for every site and types them in for you, so you don’t have to remember them. Using one is one of the easiest ways to protect your WA.gov account.

Related articles