Passkey login for WordPress

What it does

Passkeys replace passwords with cryptographic credentials stored on the user's device and unlocked by the device itself. There is nothing to phish, nothing to reuse and nothing to leak in a database dump.

For users who are not ready for passkeys, magic-link login sends a one-time sign-in link by email, and trusted devices let approved hardware skip the second factor for a period you control.

How it works

The implementation is built on the audited open-source WebAuthn framework. You choose which roles may or must use passkeys; enforcement comes with a seven-day default grace period so nobody is stranded mid-rollout. Registration and login ceremonies default to five-minute windows, and user verification can be required.

Passkey forms integrate with WooCommerce, membership and Easy Digital Downloads login screens, ship as shortcodes for custom pages, and every registration is tracked in a passkey log.

• WebAuthn passkeys with per-role enforcement and grace period
• Magic-link login with optional IP verification and CAPTCHA
• Trusted devices: 30-day default, max 5, new-device notifications
• WooCommerce, membership and EDD login form integration
• Shortcodes for custom login and registration pages
• Passkey activity log with configurable retention