Mohamed Endisha

Secure Passkeys is a powerful WordPress plugin that enables seamless passwordless authentication using WebAuthn technology. By eliminating the need for traditional passwords, it enhances security and improves the user login experience. With support for biometric authentication, security keys, and device-bound credentials, Secure Passkey provides a robust and user-friendly solution for modern authentication.
Unlike traditional password-based authentication, Secure Passkey leverages cryptographic key pairs to ensure secure logins. The private key remains securely stored on the user’s device, while the public key is registered with the WordPress site. This method protects against phishing attacks and password breaches, ensuring that only authorized users can gain access.
Secure Passkeys integrates effortlessly into WordPress, allowing users to register and manage their passkeys from their profile settings. Once registered, users can log in using their fingerprint, face recognition, or a hardware security key without the need to remember or enter a password.
<h3>Features</h3>
<ul>
<li>Passwordless Login: Secure authentication via WebAuthn with biometric devices, security keys, Touch ID, Face ID, and more.</li>
<li>Enhanced User Experience: Password-free login for a smoother user journey.</li>
<li>Integration Support:
<ul>
<li>WordPress default login form</li>
<li>WooCommerce login page</li>
<li>MemberPress login form</li>
<li>Easy Digital Downloads login form</li>
<li>Ultimate Member login form</li>
</ul>
</li>
<li>Admin Management: Administrators can delete, activate, or deactivate users directly from plugin settings or user profiles.</li>
<li>Passkeys Reminder Notice: New option to enable or disable the passkeys reminder notice in the WordPress admin area for users who have not yet enabled passkeys.</li>
<li>Activity Logging: Monitor activity logs and track last login/registration of passkeys.</li>
<li>Multiple Passkeys: Supports multiple passkey registrations per user, with the option to set a registration limit or allow unlimited registrations.</li>
<li>Role Restrictions: Restrict and exclude specific user roles from using passkey authentication.</li>
<li>Customizable Settings: Adjust timeout settings for passkey registration and login.</li>
<li>User Verification: Enforce user verification for enhanced security.</li>
<li>Frontend Customization: Easily customize frontend themes or add your own with basic frontend skills.</li>
<li>Theme Support: Supports pre-built themes like YOOtheme (UIkit) for frontend shortcodes.</li>
<li>Shortcodes: Embed passkey login and registration forms on custom frontend pages.</li>
<li>Passkey Display: Show passkey details in admin user lists and profiles.</li>
<li>Multisite: Supports WordPress Multisite and single-site installations.</li>
<li>Database Optimization: Option to allow or disallow automatic deletion of old challenge records and activity logs (configurable schedule).</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>WordPress 6.0 or newer.</li>
<li>PHP version 7.4 or newer.</li>
</ul>
<h3>License</h3>
Secure Passkeys is licensed under the GNU General Public License v2 or later.

Secure Passkeys


This is the best Passkey plugin for WP that I have ever used! Absolutely amazing work! Thank you !!


Awesome!!!!

Perfect - lightweight, simple and free

Secure Passkeys is a powerful WordPress plugin that enables passwordless authentication using WebAuthn technology.

Anna Garcia

Are you or your customers tired of remembering passwords?
This plugin provides a secure and convenient solution to log into your WordPress website. With Beyond Identity, you can say goodbye to password fatigue and improve your website’s security.
Once activated, you will see:
<ul>
<li>
Passwordless UI that integrates seamlessly on with the WordPress login page.
</li>
<li>
Beyond Identity Settings page for WordPress admins to configure their Beyond Identity account.
</li>
<li>
Beyond Identity filter on the WordPress Dashboard’s Users page to view which users use passkeys.
</li>
</ul>
Before you begin
You will need a Beyond Identity account to configure this plugin. 
Beyond Identity currently uses “Universal Passkeys,” which are specific to Beyond Identity and have two benefits over your average FIDO2 passkeys. 
1. Universal Passkeys never leave the device on which they are created. This makes them much more secure. 
2. Universal Passkeys work everywhere. Some browsers (Firefox) do not support passkeys. Universal Passkeys work everywhere, even on Firefox.
Coming soon: Vanilla WebAuthn FIDO2 passkeys. These passkeys allow syncing between devices and work with passkey managers.
As a Beyond Identity admin, you will have several configuration options including selecting passkey flavors and customizing the login page.
<h3>Admin Set Up</h3>
First, sign up for a free developer account by visiting: https://www.beyondidentity.com/developers
Once you have a developer account you will need to set several values for the OIDC server. Follow the steps below to configure a Beyond Identity application. Most defaults are fine. However make sure the following are set:
<ol>
<li>In your Beyond Identity Console, navigate to the Apps tab under Authentication</li>
<li>Tap Add an application</li>
<li>Set Protocol to OIDC</li>
<li>Set Client Type to Confidential</li>
<li>Set PKCE to Disabled</li>
<li>Set Redirect URIs to include <code>https://${your-website-domain.com}/wp-admin/admin-ajax.php?action=openid-connect-authorize</code></li>
<li>Set Token Configuration > Subject to id</li>
<li>At the top of the page, navigate to your application’s Authenticator Config tab</li>
<li>Set Configuration Type to Hosted Web</li>
<li>The recommended defaults for Authentication Profile are fine but feel free to modify</li>
<li>Tap the Submit button to save your changes</li>
</ol>
Finally, go to your WordPress dashboard and find the Beyond Identity Settings page. You will need three generated values from your newly created application. You can find the Issuer URL, Client ID, and Client Secret in the Beyond Identity Console’s application that you just created.
For more information on how Beyond Identity works, visit the <a href="http://developer.beyondidentity.com" rel="nofollow ugc">developer documentation</a>.
For help, reach out on <a href="https://join.slack.com/t/byndid/shared_invite/zt-1anns8n83-NQX4JvW7coi9dksADxgeBQ" rel="nofollow ugc">Slack</a>.
<h3>Shortcodes</h3>
This plugin also provides shortcodes that can be used on any page or post. These include:
<pre><code>[beyond_identity_login_button] 
</code></pre>
Generates a button to log in with a Beyond Identity Universal Passkey.
<pre><code>[beyond_identity_auth_url] 
</code></pre>
Generates the authorize URL to log in with a Beyond Identity Universal Passkey.
For information on shortcode customization attributes, please refer to the documentation available in the Settings > Beyond Identity dashboard page after activating the plugin.

Beyond Identity Passwordless

A passwordless solution that allows users and admins to log into a WordPress website using passkeys with Beyond Identity.

Secure Passkeys vs Beyond Identity Passwordless