Volodymyr Kolesnykov

<p>This plugin adds WebAuthn and passkey support to the <a href="https://wordpress.org/plugins/two-factor/" rel="ugc">Two Factor</a> plugin, providing a modern, secure authentication method.</p>
<p><strong>Features:</strong></p>
<ul>
<li>Support for WebAuthn and passkeys (Windows Hello, Touch ID, YubiKeys, etc.)</li>
<li>Backward compatibility with previously registered U2F security keys</li>
<li>User-friendly settings and seamless authentication experience</li>
<li>Customizable error logging and behavior via action hooks</li>
<li>Works with the Two Factor plugin for flexible 2FA authentication</li>
</ul>
<p>The plugin enables users to register and use hardware security keys and platform authenticators for stronger protection against password-based attacks and phishing.</p>
<p>Notes:</p>
<ul>
<li>please use <a href="https://github.com/sjinks/wp-two-factor-provider-webauthn/issues" rel="nofollow ugc">GitHub issues</a> to report bugs;</li>
<li>the full source code with all development files is available on <a href="https://github.com/sjinks/wp-two-factor-provider-webauthn" rel="nofollow ugc">GitHub</a>.</li>
</ul>


WebAuthn Provider for Two Factor

Thank you so much for this plugin!!  

In February 2022 Chrome changed things so hardware security keys would no longer work with the "Two Factor" plugin. Installing this add-on gets it working again. 

I had to change the "User Verification Requirement" to "Discouraged" in order to use my existing Yubikey (without re-adding it). Otherwise, it asked for a PIN but then wouldn't recognize my key.

Hopefully it can get merged directly into the Two Factor plugin soon? 😁🙏

Two Factor works with hardware keys again!

Thank you for bridging the gap while we wait for the PR. 
This is what Open Source is all about. 

FIDO U2F WebAuthn for Two Factor


This is helpful for evaluating purposes of the code. As this plugin is part of a security level all the code should be readable easily for auditors.



Besides that, well done.Thank you.


Works well for my use case but please provide unminified JS files.


This is great. You can literally log into WordPress with 2FA using one touch (password manager with auto-login combined with this for 2FA). Beats using an authenticator app any day.


One touch 2FA is a dream

WebAuthn authentication provider for Two Factor plugin.

susheelhbti

<p><strong>Keyless Login</strong> brings modern, phishing-resistant authentication to your WordPress site.</p>
<p>Log in with your fingerprint, face, or a hardware security key — no password ever required or transmitted. Implemented entirely in pure PHP using only the built-in <code>openssl</code> extension. No Composer, no vendor folder, no third-party libraries.</p>
<h4>How It Works</h4>
<p>KeylessWP implements the <a href="https://www.w3.org/TR/webauthn-2/" rel="nofollow ugc">W3C WebAuthn Level 2</a> specification from scratch:</p>
<ul>
<li>A custom CBOR decoder parses authenticator data</li>
<li>Custom ASN.1/DER builders construct public keys</li>
<li>PHP’s built-in <code>openssl_verify()</code> verifies ECDSA P-256 (ES256) and RSA-2048 (RS256) signatures</li>
<li>Credentials are stored in a dedicated database table with sign-count clone detection</li>
</ul>
<h4>Supported Authentication Methods</h4>
<ul>
<li>🖐 Fingerprint sensors (Touch ID, Windows Hello)</li>
<li>😊 Face recognition (Face ID, Windows Hello face camera)</li>
<li>🔑 Hardware security keys (YubiKey, Google Titan Key, Feitian)</li>
<li>🔐 Platform passkey managers (iCloud Keychain, Google Password Manager)</li>
</ul>
<h4>Features</h4>
<ul>
<li>Full FIDO2 / WebAuthn Level 2 implementation — pure PHP</li>
<li>ECDSA P-256 (ES256) and RSA-2048 (RS256) signature verification</li>
<li>Zero external libraries — only PHP’s built-in <code>openssl</code> extension required</li>
<li>Passkey registration and management from the user profile page</li>
<li>Per-credential device naming, creation date, and last-used tracking</li>
<li>Sign-count verification on every authentication (clone detection)</li>
<li>Phishing-resistant: credentials are cryptographically bound to your domain</li>
<li>Admin settings page with live usage statistics</li>
<li>Graceful fallback: the standard password form remains available</li>
<li>Translatable — all strings use <code>__()</code> with the <code>keylesswp</code> text domain</li>
</ul>
<h4>Privacy</h4>
<p>KeylessWP does not collect, transmit, or share any user data. No external services are contacted. Biometric data never leaves the user’s device — only a cryptographic public key is stored on the server.</p>


Keyless Login

Passwordless WebAuthn/FIDO2 login for WordPress. 100% pure PHP, zero external dependencies.

WebAuthn Provider for Two Factor vs Keyless Login