ESR Login Help for NHS Staff: Sign-In and Problems

This guide is for NHS staff who are stuck at the ESR login screen, whether that is a forgotten password, a locked account, a smartcard that will not work or a first login that never arrived. It describes the stable parts of how ESR sign-in works, as published by the NHS Business Services Authority (NHSBSA). Screens and local rules differ by employer, so treat the steps as a map, not a script. FrontlinePay is independent and is not affiliated with NHSBSA, NHS England or any NHS employer.

What ESR is and who uses it

ESR stands for Electronic Staff Record. NHSBSA describes it as a workforce management system used across the NHS in England and Wales, combining HR and payroll in one system, with learning management and performance management alongside. For you as an employee, ESR is usually where your payslips and P60 live, where you keep your personal details and bank account, and where mandatory training is recorded. Our guide to what you can do in ESR employee self-service covers the full list.

Because NHSBSA describes ESR as the England and Wales system, staff in Scotland and Northern Ireland should ask their own employer which payroll and HR systems they use rather than assume this guide applies.

How you sign in

NHSBSA's functional guide to ESR employee self-service says that to reach the ESR portal, every user needs either a smartcard, or a username and password. Beyond that, the details are local.

NHSBSA's guide also describes a lower access level of employee self-service that does not require a smartcard. Which level your employer has given you decides what you see. If your colleagues sign in one way and you cannot, ask your ESR team which route is set up on your record.

Forgotten password or locked account

NHSBSA publishes a one-page guide called "How do I reset my password?". It says that when you use ESR over the internet you have 5 attempts to enter your password correctly before the account is locked, and that the same reset route covers both a forgotten password and a locked account. The sequence it describes:

Password rules

The ESR Hub's page on managing your password states these rules:

• ✓ At least 12 characters.
• ✓ Not the same as any of your previous 4 ESR passwords.
• ✓ Not a commonly used password such as "password1".
• ✓ There is no national minimum expiry period: whether your password expires at all is set by your organisation.

The Hub points to National Cyber Security Centre advice to build a password from three random words, and suggests a password manager. Compare this with the My NHS Pension portal, which has completely different password rules (see the My NHS Pension password rules). The two systems are separate and one password does not carry across.

Smartcard problems

NHS England's Digital pages on the Care Identity Service say smartcards are managed locally by each organisation's Registration Authority. They describe three useful things. You can unlock your own smartcard using self-service unlock without finding the Registration Authority. You can self-renew a smartcard certificate that has not yet expired. An expired certificate, or any other smartcard problem not covered by self-service, goes to your Registration Authority. The same pages note that smartcard problems are almost always traced back to software or device set-up, which is a job for your local IT team.

If your smartcard works for clinical systems but you still cannot reach ESR, the smartcard is probably not the issue. Ask your ESR team whether your account is set up for smartcard sign-in, username and password, or both.

Who can actually fix it

The ESR Hub's "Looking for help" page sets out the route for staff:

• • Login or system access problems: contact the system administrator at your organisation.
• • Cannot find them: the Hub links to a search tool at esrsupport.co.uk listing the contacts that organisations have chosen to publish.
• • Nothing listed: contact your HR team.
• • Password problems: read the password guidance and reset guide on the Hub first, and contact your local system administrator if that does not work.

The Hub does not publish a phone number or email address for staff queries, and NHSBSA's pages for ESR direct employees back to their employer. If your payslip looks wrong rather than your login, the person to contact is different: see who to contact about wrong pay.

When you contact them, say which route you are using (smartcard or username and password), whether you have tried the Forgotten link, what the screen says exactly, and which email address you think is on your record. Do not send your password to anyone.

The ESR app and mobile access

NHSBSA publishes an app called MyESR on Apple's App Store. Its listing describes it as a hub of quick links, including to your ESR self-service account and payslips, the ESR user manual, service status and the Total Reward Statement portal. The listing says the app does not hold your records itself. In other words it points you at the same ESR sign-in rather than offering a separate login, so a locked ESR account is still locked when you use it. NHSBSA's guide also says employee self-service can be reached on laptops, smartphones and tablets.

When ESR is down for maintenance

NHSBSA says ESR is sometimes taken offline to apply essential changes, for example pay awards, pension changes and security updates, and that nobody can log in during those periods. When we checked the ESR Hub on 19 October 2026 it carried a notice of planned unavailability from 6pm on Friday 30 October until 11.59pm on Sunday 1 November. Check the Hub for the current position, because such notices change.

NHSBSA also publishes a guide for viewing your latest payslip while the full service is offline, when the ESR Hub itself is still available. It is covered on our page about how to see your payslip on ESR. Note that NHSBSA says you cannot reset your password through that route.

If you have left your job

People often hit a login problem right after leaving, because the work email address on the ESR record is closed. NHSBSA's Leavers Dashboard FAQ makes this point: leavers who forget their login details need a way to reset their password without a work email. It also says that organisations can choose how long leavers keep access, with a default maximum of 90 days. Our page on getting your P60 and P45 explains what a leaver can still download and why the safest time to act is before your last day.

Sources and date checked

Everything above was checked on 19 October 2026 against these NHS pages. Screens and policies change, so treat the originals as authoritative.

• ESR Hub: Looking for help
• ESR Hub: Managing your ESR password
• ESR Hub: Multi-factor authentication
• NHSBSA, "How do I reset my password?" (PDF linked from the Looking for help page)
• NHSBSA, ESR Employee Self Service functional guide (PDF linked from the ESR Hub, "Implementing Employee Self Service")
• NHSBSA: Electronic Staff Record
• NHS England Digital: Care Identity Service (smartcards and Registration Authorities)

Related guides

This guide is general information about how ESR sign-in works, as published by the NHS Business Services Authority and NHS England Digital at the date shown. It is not affiliated with either body, any NHS employer or ESR, and is not IT, legal or financial advice. For your own account, the ESR team or HR team at your employer is the only party that can help.