Rapls Passkey – Passwordless Login with WebAuthn

It needs OpenSSL, which checks the passkey signatures and is one of the modules WordPress's Site Health already looks for. It does not need gmp: the large-number maths WebAuthn needs uses gmp or bcmath when one is installed, and plain PHP when neither is.

Yes. There is no extension to install, no persistent process, and nothing written outside the plugin's own table and options.

Any current browser with a built-in authenticator — Touch ID, Windows Hello, Face ID — or a FIDO2 security key. If the machine in front of you has no passkey for the site, the browser's own cross-device flow lets you scan with your phone instead.

No. Passkey sign-in, registration, management, the shortcodes and blocks, the administrator's passkey list and the two-factor integrations are all in the free plugin, without a cap, a trial period or a licence key. Rapls Passkey Pro is a separate add-on that adds different features — cross-device QR login, recovery codes, enforcement by role — and installing it is not required for anything described above to work.

It is built to sit alongside them rather than replace them. A plugin that changes the login URL keeps doing so, and the passkey button appears on whatever login screen your site actually serves; the developer's own site runs it this way with CloudSecure WP Security. If your security plugin restricts the REST API to logged-in users, turn on "Passkey login when REST is restricted" under Settings → Rapls Passkey → REST API, so the sign-in can start before anyone is logged in. With Wordfence Login Security or Two-Factor, a passkey satisfies the second factor, and a weaker alternative login still has to pass the site's own 2FA.

Yes. The Japanese translation is complete, and WordPress.org serves it as a language pack — no bundled catalogue, so it updates independently of the plugin.

Password login still works alongside passkeys, so sign in with your password as usual and then remove or re-register passkeys from your profile screen. You can also manage passkeys from the server with WP-CLI: wp rapls-passkey list --user=admin wp rapls-passkey remove In an emergency, add the following to wp-config.php. It switches off every passkey requirement and second-factor check this plugin applies; remove it once you have recovered: define( 'RAPLS_PASSKEY_BYPASS', true );

Not by default. A passkey is bound to the domain it was registered on, and that binding is kept inside the authenticator, not in the database — so moving the database to production does not carry it across. A passkey registered on staging.example.com is not offered on example.com. Either register again on the live site and treat staging passkeys as disposable, or have both sites use the parent domain before anyone registers: add_filter( 'rapls_passkey_rp_id', function () { return 'example.com'; } ); With the second, passkeys registered on staging keep working once the database moves to production, including any you did not mean to keep. Passkeys made on localhost only ever work on localhost. The setup screen shows the relying-party ID in use, so this can be settled before the first passkey is registered.