New mod: SMFPacks Passkeys Pro 1.0.0 — passwordless sign-in for SMF 2.1

We're happy to announce SMFPacks Passkeys Pro, a new modification that brings passkeys (WebAuthn) to SMF 2.1. Your members can sign in with Face ID, Touch ID, Windows Hello, a phone, or a hardware security key — no password typed, nothing to phish, nothing to reuse across sites.


What it does

• Sign in with a passkey — a passkey button is added to every login form: the login page, the AJAX login overlay, the failed-login retry page and the guest kick page. Works even when guest access is disabled. Includes a theme-agnostic fallback for custom themes.
• Easy self-service management — members register and manage their passkeys in Profile > Passkeys, with friendly names for each device. Registration takes seconds.
• Optional passkey-only sign-in — members who want maximum security can turn off password login for their account entirely and sign in exclusively with passkeys.
• Admin tools — anyone with the edit any profile permission can open a member's Passkeys profile area to remove passkeys or turn passkey-only sign-in off for them.
• Safe, admin-mediated recovery — if a passkey-only member loses their passkeys, they can request help from a recovery page. The request emails the administrators (and the member, so unrequested attempts are noticed), and an admin re-enables password login after verifying it. Recovery deliberately never self-completes via an emailed link — a compromised inbox can't silently downgrade an account back to password sign-in.
• Emergency kill switch — add $disable_passkeys = true; to Settings.php and every account can sign in with its password again. Handy if an admin enables passkey-only sign-in and then loses their own passkeys. Remove the line and everything comes back; credentials and settings are kept.
• Translations included — English, Spanish (Spain), Spanish (Latin America), French, German and Italian, each with a UTF-8 variant.

Security details, for those who want them

The mod validates the WebAuthn challenge, origin, RP ID hash, user presence, ES256 assertion signatures and authenticator counters. Credentials are stored in their own table — opaque credential IDs, public keys, counters, timestamps and labels. No passwords are ever stored or replaced by this mod, and uninstalling leaves the credential table in place so nothing is deleted accidentally.

Requirements

• SMF 2.1.x
• HTTPS with a stable domain name (browsers require a secure origin for passkeys)
• PHP with OpenSSL enabled

Not sure it will work on your forum?

Install the free SMFPacks Passkeys Compatibility Test package first. It checks your server and your browser and gives a clear verdict on whether passkeys will work — before you buy.

Get it

• SMFPacks Passkeys Pro — product page
• Free compatibility test package (direct download)