Rapls Passkey adds passkey sign-in to WordPress. Touch ID, Windows Hello, Face ID or a security key takes the place of the password, and your server never holds a shared secret. It stores only a public key, which is useless to anyone who steals it. A video walkthrough (in Japanese): It is built to r
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.0 and PHP 8.2.
SourceWordPress plugins · Oct 28, 2026
01 / Source details
Aboutthistool.
Rapls Passkey adds passkey sign-in to WordPress. Touch ID, Windows Hello, Face ID or a security key takes the place of the password, and your server never holds a shared secret. It stores only a public key, which is useless to anyone who steals it.
A video walkthrough (in Japanese):
It is built to run where most WordPress sites actually run:
Fewer moving parts. Nothing to configure before the first passkey, and no gmp to ask your host for: the large-number maths WebAuthn needs uses gmp or bcmath when one is installed and plain PHP when neither is. Signatures are checked with OpenSSL, one of the modules WordPress’s Site Health already looks for.
Nothing leaves your site. The passkey ceremony happens between the browser and your own server. No account, no API key, no third-party service in the login path.
Passwords keep working. Password login is never switched off in the free plugin. Nobody gets locked out while a site moves across.
Japanese UI included. Fully translated, alongside the English source.
Same-device passkeys (Touch ID / Windows Hello / Face ID)
Cross-device sign-in using the browser’s native passkey flow when the browser offers it (scan with your phone). A custom QR approval flow is available in Pro.
Shortcodes and Gutenberg blocks (login / passkey management) you can embed on any page
Rename, suspend and resume individual passkeys — a device that is temporarily out of reach can be cut off without destroying the credential
A site-wide passkey list for administrators (Users -> Passkeys), searchable by owner or name
Works with two-factor plugins (Wordfence Login Security, Two-Factor, …): a passkey counts as the second factor, while weaker alternative logins must still pass the site’s 2FA
An audit log of registrations, sign-ins and removals, exportable as CSV
WP-CLI commands, a first-run configuration check, and an emergency bypass constant
Fully translatable UI (English source; translations come from translate.wordpress.org)
Shortcodes
Embed them in any page, post, or widget. In the block editor they are also available as the “Sign in with a passkey” and “Manage passkeys” blocks.
[rapls_passkey_login] — a passkey sign-in button for logged-out visitors. Supports the redirect (URL to go to after success) and label (button text) attributes.
[rapls_passkey_register] — a management UI where logged-in users can register and remove their own passkeys.
Requirements
WordPress 6.0 or later
PHP 8.2 or later
HTTPS, except on localhost — browsers refuse WebAuthn without it
No PHP extension beyond WordPress’s own requirements.
Rapls Passkey Pro
Everything above is free, and stays free. Pro is a separate add-on for the part that comes after the first passkey: moving a whole site across, and keeping a way in when a device goes missing.
Sign in from another device — approve a login on your computer from your phone, with a QR code and a four-digit confirmation code so a relayed code cannot be used elsewhere
A way back in that is not a password — one-time recovery codes and email magic-link sign-in
Roll out by role — require passkeys for the roles you choose, with a grace period, then turn password login off once everyone is across
Adaptive step-up — ask for a passkey again after a password sign-in from somewhere unfamiliar
Authenticator policy — FIDO Metadata Service checks, an AAGUID denylist, trusted-device management
One-time purchase, no subscription: updates with no time limit, a year of support, and a 14-day refund. Details and pricing
External services
This plugin sends nothing to any external service by default. One optional integration, off unless you turn it on, contacts a third party:
Google reCAPTCHA v3 — used only when you enable reCAPTCHA for password logins. When it is on, the visitor’s browser loads https://www.google.com/recaptcha/api.js, and the plugin sends the resulting token together with the request IP address to https://www.google.com/recaptcha/api/siteverify so that Google can score the request. Nothing is sent while the option is off. This service is provided by Google and its use is governed by Google’s terms and privacy policy:
Terms of Service: https://policies.google.com/terms
No other host is contacted. The plugin bundles the public suffix list it needs ( data/public_suffix_list.dat ) rather than fetching it, and passkey ceremonies happen between the browser and your own site.
Privacy
Authentication data is stored on your own site.
What is stored:
Passkey credential records (public key, credential ID, sign counter, a label and timestamps) in a custom database table.
A per-user WebAuthn user handle in user meta, plus one row in the options table recording that the account has one. The handle carries nothing about the person: for accounts created from this version it is derived from the account id and a site secret, and accounts that already had a random handle keep it.
An optional audit log of passkey events (registration, sign-in, removal) with the acting user, IP address and timestamp.
Retention and removal:
Passkey records remain until the user or an administrator deletes them; deleting a user removes their passkey records.
The plugin integrates with WordPress’s built-in personal-data export and erase tools, so a user’s passkey and audit data are included in export/erase requests.
Uninstalling the plugin (delete from the Plugins screen) drops its custom table and options.
This plugin does not use cookies for tracking. It sets only short-lived, functional cookies during a login ceremony (for example the pending second-factor login), which expire within minutes.
See it in action
Screenshots & previews.
Sign in with a passkey from the normal WordPress login screen.The browser offers the passkeys saved for this site.Your registered passkeys: rename, suspend or delete each one.Registering a passkey from your profile screen.Touch ID confirms before the passkey is saved.Choose where the passkey is stored.The first-run check: HTTPS, the relying-party ID, and the WebAuthn library.Every registration, sign-in and removal, exportable as CSV.
02 / Source details
Gettingstarted.
01Place the plugin in wp-content/plugins/rapls-passkey .
02Activate “Rapls Passkey” from the Plugins screen.
03Register a passkey from your profile screen.
Nothing else is required: no account, no API key, no configuration before the first passkey. The settings screen shows a first-run check (HTTPS, the relying-party ID, the WebAuthn library) so you can see the site is ready.
03 / Source details
Frequently asked questions.
Does this need any PHP extensions?
It needs OpenSSL, which checks the passkey signatures and is one of the modules WordPress’s Site Health already looks for. It does not need gmp : the large-number maths WebAuthn needs uses gmp or bcmath when one is installed, and plain PHP when neither is.
Does it work on shared hosting?
Yes. There is no extension to install, no persistent process, and nothing written outside the plugin’s own table and options.
Which browsers and devices work?
Any current browser with a built-in authenticator — Touch ID, Windows Hello, Face ID — or a FIDO2 security key. If the machine in front of you has no passkey for the site, the browser’s own cross-device flow lets you scan with your phone instead.
Is the free version limited?
No. Passkey sign-in, registration, management, the shortcodes and blocks, the administrator’s passkey list and the two-factor integrations are all in the free plugin, without a cap, a trial period or a licence key. Rapls Passkey Pro is a separate add-on that adds different features — cross-device QR login, recovery codes, enforcement by role — and installing it is not required for anything described above to work.
Does it work with my security plugin?
It is built to sit alongside them rather than replace them. A plugin that changes the login URL keeps doing so, and the passkey button appears on whatever login screen your site actually serves; the developer’s own site runs it this way with CloudSecure WP Security. If your security plugin restricts the REST API to logged-in users, turn on “Passkey login when REST is restricted” under Settings → Rapls Passkey → REST API, so the sign-in can start before anyone is logged in. With Wordfence Login Security or Two-Factor, a passkey satisfies the second factor, and a weaker alternative login still has to pass the site’s own 2FA.
Is the plugin available in Japanese?
Yes. The Japanese translation is complete, and WordPress.org serves it as a language pack — no bundled catalogue, so it updates independently of the plugin.
What if I lose my passkey and cannot sign in?
Password login still works alongside passkeys, so sign in with your password as usual and then remove or re-register passkeys from your profile screen.
You can also manage passkeys from the server with WP-CLI:
wp rapls-passkey list --user=admin wp rapls-passkey remove <id>
In an emergency, add the following to wp-config.php. It switches off every passkey requirement and second-factor check this plugin applies; remove it once you have recovered:
define( 'RAPLS_PASSKEY_BYPASS', true );
Will passkeys made on a staging site work on the live site?
Not by default. A passkey is bound to the domain it was registered on, and that binding is kept inside the authenticator, not in the database — so moving the database to production does not carry it across. A passkey registered on staging.example.com is not offered on example.com.
Either register again on the live site and treat staging passkeys as disposable, or have both sites use the parent domain before anyone registers:
add_filter( 'rapls_passkey_rp_id', function () { return 'example.com'; } );
With the second, passkeys registered on staging keep working once the database moves to production, including any you did not mean to keep. Passkeys made on localhost only ever work on localhost. The setup screen shows the relying-party ID in use, so this can be settled before the first passkey is registered.
Website LLMs.txt and LLMs-Full.txt Generator is an LLMs.txt generator and llms-full.txt generator for WordPress. It helps site owners generate, manage, preview, validate, and serve AI discovery files from published public content. Use it to create structured /llms.txt and optional /llms-full.txt end
EngageDock AI is a customizable floating contact widget for WordPress websites that want more leads and faster visitor communication. It helps small businesses turn website traffic into calls, texts, emails, and callback requests from one clean contact panel. Key Features: Click-to-Call – One tap ca
Altify AI is an auto ALT text and AI ALT text plugin for WordPress images. It helps generate descriptive image ALT text for accessibility and image SEO. Use bulk image ALT text tools for your Media Library, generate featured image ALT text automatically, and scale WooCommerce image ALT updates with
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
