Loved by store owners in 158+ countries
This WooCommerce biometric login plugin lets customers and staff sign in with Face ID, Touch ID, Windows Hello, a fingerprint or a security key. No password to type, forget or reset.
Rated 4.9/5 across Trustpilot, Google and Envato
Featured across the WordPress community
WooCommerce biometric login lets shoppers sign in to your store with the fingerprint, face scan or screen lock on their own device. It works through passkeys, the sign in standard built into iPhone, Android, Mac and Windows.
The scan never leaves the device. Your store keeps only a public key, and a fake login page cannot use it. Read more about how passkeys work.
WooCommerce has no passkey sign in of its own. This plugin adds it to the My Account and checkout login, and it is part of our WooCommerce extensions range.
The FIDO Alliance asked 11,000 consumers in 2026. 47% said they are likely to abandon a purchase or sign in when they forget a password.
Stolen passwords are the other half of the problem. Credential stuffing made up a median 19% of all sign in attempts in Verizon's 2025 research, and 12% at small businesses.
See how passkeys fix itA customer adds a passkey once. After that, signing in is one tap and a fingerprint or face scan.
From My Account, or from the invitation after they sign in or check out. Their device creates a key pair.
The private key stays on the device. No fingerprint, face or password is ever sent to your store.
No username needed. The device asks for a fingerprint, face scan or PIN and signs a one-time challenge.
The challenge, your domain and the key are verified on the server. Then the customer is signed in.
Faster sign in for customers, passkeys you can require for staff, and the tools to see and control it all.
A "Sign in with a passkey" button sits on the My Account login form. Customers tap it, confirm with a fingerprint or face scan, and they are in.
They do not even type a username, because the passkey finds the account. On supported browsers, saved passkeys also appear in the username field through passkey autofill.
Returning customers open "Returning customer?" at checkout and sign in with their passkey. Their saved address fills in and they can pay right away.
It works on the classic checkout login form. The Checkout block links to the My Account login, which has the button.
Turn on the button for the wp-login.php screen and your team signs in to wp-admin with a passkey too. Staff add theirs from their own user profile.
Admins can see, suspend or remove anyone's passkeys from the user profile. The Users screen gets a Passkeys column.
A Passkeys page in My Account lists every device a customer added, such as "Safari on iPhone", with when it was added and last used.
Customers add a new passkey, rename one, suspend it or remove it. You set how many passkeys each person can keep.
After the first passkey, customers get ten one-time recovery codes to copy or download. Only hashes of the codes are stored on your store.
If a device is lost, the customer clicks "Use a recovery code" on the login form and gets back in. No reset email is needed.
Passkeys only help customers who add one. A short invitation appears right after a password sign in, after registration and on the order received page.
A card on the My Account dashboard covers everyone else. "Not now" hides it for 30 days, and you write the title and text.
Pick the roles that must use a passkey, such as administrators and shop managers. They get reminders during a grace period, seven days by default.
After that, they can only reach their passkey page until they add one. Customers stay free to choose.
For the roles you choose, a password stops working once the user has a passkey. A stolen or reused password is then useless on that account.
Application passwords are turned off for them too. They sign in with the passkey or one of their recovery codes.
An IP address that fails five passkey or recovery code attempts is locked out for 15 minutes. You set both numbers.
Behind Cloudflare or a load balancer, the plugin can read the real visitor IP. For password logins, see our guide to WordPress brute force protection.
Customers get an email when a passkey is added or removed, and when a recovery code signs them in. If it was not them, they can act at once.
You get an alert when an IP address is locked out, and optionally when staff sign in with a passkey. Emails use your WooCommerce template.
Pick filled, outline, dark, light or your theme's own button style. Set the colors, the text and the fingerprint icon, with a live preview.
Place the button above or below the password form and change the "or" divider. Every customer-facing text can be rewritten.
Put the passkey login button or the passkey manager on any page. Use the two blocks in the block editor, the Elementor widgets or the shortcodes.
The login button takes its own text and a redirect after sign in. It hides for customers who are already signed in.
Eight cards show passkey logins, new passkeys, failed attempts, success rate, customers with passkeys and adoption rate. Each compares with the period before.
A chart plots sign ins, new passkeys and failures per day. An environment check confirms HTTPS and the PHP extensions passkeys need.
The Passkeys screen lists every passkey with its owner, type, status and last use. Suspend, reactivate or revoke one at a time or in bulk.
The Activity log records ten event types with IP address and device. Filter by event and date and export the list to CSV.
No app for your customers and no theme edits for you. The dashboard checks your server for you.
Passkey sign in hooks into the standard WooCommerce and WordPress login forms. The passkey library loads only on pages that use it.
Most passkey plugins are built for the WordPress admin, or come inside a large security suite. This one is built around the WooCommerce customer.
My Account, the checkout login and wp-login.php, plus blocks and widgets for any page.
Saved passkeys appear in the username field on supported browsers. One tap and done.
One-time recovery codes get customers back in when a device is lost.
Enforce passkeys for the roles that matter with a grace period. Customers choose.
Customers are asked at the right moments. A no hides the invitation for 30 days.
Emails for new passkeys, removed passkeys, recovery codes, lockouts and staff sign ins.
Passkey logins, success rate, adoption and failed attempts for any date range.
Only public keys are stored. Fingerprints and faces never leave the device.
A six-step setup wizard turns it on, places the button and sets security defaults.
We are official WooCommerce core contributors, and this plugin sits beside our other WooCommerce plugins.
More than 20 accepted contributions to WooCommerce core. The same care goes into how this plugin signs people in.
More than $125,000 in sales and 500+ five-star reviews across Trustpilot, Google and Envato.
A short setup wizard places the button, styles it and turns on recovery codes and alerts.
Real WooCommerce developers answer your tickets. Every plan includes priority support and a 14-day refund.
The passkey library loads only on pages with a passkey button. Everything else stays as it was.
Every label is translation ready and every customer-facing text can be rewritten.
Elite Author
Sold more than $125,000 on Envato Market.
Featured Author
Made it to the Authors' Hall of Fame.
Community Health
Took part in community research initiatives.
WP Compliant
Keeps items to current WordPress standards.
Copyright Ninja
Helped protect against copyright violations.
Feedback Guru
Joined a group to improve the experience.
Trendsetter
Had an item that was trending.
Featured Item
Had an item featured on Envato Market.
Regulars sign in with one tap instead of hunting for a password on their phone.
Members who sign in often get the fastest route into their account.
Saved cards, store credit or loyalty points deserve more than a password. Pair it with our WooCommerce CAPTCHA plugin.
Buyers who reorder every week skip the password, and you can require passkeys for their role.
Require passkeys for shop managers and admins, with alerts when staff sign in.
Use the blocks, widgets and hooks to fit each client's login flow. Need more? Our WooCommerce development team builds the rest.
Upload the plugin and activate it. The setup wizard opens and asks for your license key.
My Account, the checkout login and wp-login.php. Turn on passkey autofill.
Match the button to your store. Turn on invitations, recovery codes, emails and lockout alerts.
Add one from your profile, sign out and sign back in with it. Then require it for staff.
Reviews from verified buyers of our WooCommerce biometric login plugin. Bought it? Your review helps the next store owner decide.
4.9/ 5
13 reviews
Reliable Plugin with Great Improvements
I’ve been using this plugin again after some time, and I’m really happy with how well it works now. It does exactly what it’s supposed to do and runs smoothly without issues. The setup…
High-Quality Plugin with Great Support
This is a high-quality plugin that works exactly as described. It’s very easy to set up, and the support team is really helpful. Great experience overall!
Adds Secure and Flexible Login Options
I really like this feature as it gives customers more login options with advanced security. It’s a great addition that improves both usability and protection.
Highly Recommended Plugin
It works amazingly well and delivers great results. 100% recommended!
Promising Plugin with Outstanding Support
The plugin works perfectly and delivers exactly what it promises. The support team is incredibly helpful and quick to respond. It’s a great combination of quality and service. Couldn’t ask for more!
Exactly What I Needed
I’ve been searching for a solution like this for a long time. The plugin works great and does exactly what I needed. I do wish it had WebAuthN support, but overall it’s a great…
Best WooCommerce Biometric Login Plugin!!
I usually write reviews when things don’t work as expected but not this time. This plugin is well-designed, polished, and works perfectly right from the start. It’s a great addition to any website, and…
Excellent Support
The customer support is excellent. They are always available to help and resolve issues quickly. A very smooth and reliable experience!
Well-Built WooCommerce Biometric Plugin
Great plugin! It’s very well coded and works smoothly. The support is also amazingly fast and helpful.
Excellent Biometric Plugin
Excellent script with great support! The team keeps improving and pushing new ideas. Really impressed with their innovation and dedication.
Excellent Quality with Professional Support
I was looking for German-ready resources, and I’m very satisfied with this plugin. The product quality, pricing, and features are all excellent. What stands out most is the service. Transparent, trustworthy, and highly professional.…
Finally a WebAuthn Plugin That Actually Works
This is the only WebAuthn plugin for WordPress I found that actually works. I tried many others, but they were either broken, too complicated, or too expensive. This one had a few minor issues…
Our support inbox told the same story every week. A customer forgets a password at checkout, the reset email lands in spam and the order never happens.
Store staff had their own version of it. One shared admin password, and no idea who used it.
Version 2 of Biometric Login for WooCommerce is built around passkeys. Customers sign in with the fingerprint or face scan already on their phone. Staff can be required to use one, and a lost device has a way back without email.
One yearly price with every feature in it. No add-ons and no limits on customers, passkeys or sign ins.
Every plan works as long as your subscription stays active. It renews yearly until you cancel, and you can cancel anytime from your account. Every plan is backed by our 14-day refund policy.
$49/year
Just $4.08/mo when billed annually
$199/year
Just $16.58/mo when billed annually
$299/year
Just $24.92/mo when billed annually
If the plugin does not work as promised on your site, you have the backup of our 14-day refund policy to ask for your money back.
Every screen below comes from the plugin running a real WooCommerce store. The live demo is the same build and needs no account.
5 releases Updated Oct 22, 2026
Latest Major release
38 changes
1 change
2 changes
1 change
Major release
1 change
No changes of this type yet.
Answers to what store owners ask us most about passkeys and biometric login on WooCommerce.
Ask a QuestionIt lets customers sign in to your WooCommerce store with Face ID, Touch ID, Windows Hello, a fingerprint or a security key. It uses passkeys, the WebAuthn sign in standard built into current phones, computers and browsers.
Almost. The passkey is a key pair saved on the device, and the fingerprint or face scan proves the owner is present. A device PIN or a hardware security key works too.
No. The fingerprint or face check happens on the customer's device. Your store keeps only the passkey's public key, its ID and a device name.
On the My Account login form and the classic checkout "Returning customer?" form by default, and on wp-login.php if you turn it on. Blocks, Elementor widgets and shortcodes put it on any other page.
The Checkout block has no login form of its own. It links to the My Account login, where customers find the passkey button. The classic checkout shows the button in its login form.
No. Passkeys are built into iPhone, iPad, Mac, Android, Windows and current versions of Safari, Chrome, Edge and Firefox. Your store needs HTTPS.
Passkeys saved in iCloud Keychain or Google Password Manager come back on a new device. Otherwise the customer signs in with one of their recovery codes and adds a new passkey.
They sign in with their password as before. Invitations after sign in, after registration and on the order received page help them add one.
Yes. Pick the roles in Security settings and set a grace period. After it ends, those users can only reach their passkey page until they add one.
Yes, per role. With passkey-only sign in, a user's password stops working once they have a passkey. Turn on recovery codes and add your own passkey first.
Yes. A fake login page cannot use a passkey, because each one is tied to your domain. The FIDO Passkey Index 2026 found passkey sign ins succeed 93% of the time.
It locks out an IP address after repeated failed passkey or recovery code attempts, five tries and 15 minutes by default. You get an email alert for each lockout.
Password logins need their own limit. See how to limit login attempts in WordPress.
A passkey already pairs the user's device with a fingerprint, face or PIN. Passkey sign ins skip the password step, and password-based two-factor checks do not run on them.
Test your setup on a staging site first. Comparing options? See the best WooCommerce two-factor authentication plugins.
HTTPS, a domain name and PHP 7.4 or newer with OpenSSL, GMP or BCMath, and multibyte strings. The Environment Check on the dashboard shows each item as Ready or Action needed.
Passkeys belong to the domain they were created on. After a domain change, customers sign in with their password or a recovery code and add a new passkey. The same applies to a staging site on another domain.
No biometric data is stored. Passkeys and sign in activity, including IP addresses, are part of the WordPress personal data export and erase tools. Old activity is deleted on a schedule you set.
Customers with a passkey skip the reset page entirely. For everyone else, you can still customize the WordPress reset password page.
No. Biometric Login is a premium plugin with one edition. Try every screen on the live demo, read the setup docs, or compare the best WooCommerce biometric plugins.
Add WooCommerce biometric login with passkeys to My Account, checkout and wp-admin, with recovery codes and alerts built in. Try the live demo and then pick a plan.
What you get the day you turn it on.
from 500+ reviews
Store owners in 158+ countries run on DevDiggers.
Elite Author with $125,000+ in sales.
