Passkey Login at Checkout: Faster, Safer Sign-In for UK Shops

If you've ever watched a returning customer get stuck at "Forgot your password?" halfway through checkout, you already know the problem. They wanted to buy. Your login form got in the way.

The short answer: a passkey lets a customer sign in with their fingerprint, face or phone PIN instead of a password. It's faster, it can't be phished, and there's no password to reuse or leak. On Shopify you get passkeys through Shop Pay today. On WooCommerce you need an extension. On OpenCart and custom builds it's development work. Whatever the platform, keep guest checkout and a fallback sign-in, because not every customer will have a passkey.

Here's how it works, what each platform can do right now, and the mistakes to avoid.

What is a passkey?

A passkey is a login that lives on the customer's device instead of in their head. When they create one, their phone or computer makes a pair of cryptographic keys. Your site keeps the public key. The private key stays in their credential manager, such as Apple Passwords, Google Password Manager or Samsung Pass.

To sign in, they confirm it's them with whatever they already use to open their device: Face ID, a fingerprint or a PIN. Nothing gets typed and nothing secret gets sent to your server.

Passkeys are built on the FIDO2 and WebAuthn standards, so they work the same way across Apple, Google and Microsoft devices. Most of them sync, so a passkey made on an iPhone is there on the customer's Mac too.

Why do passkeys reduce checkout friction?

Logging in is one of the slowest steps in a returning customer's checkout. They have to remember which email they used, then a password, then sometimes wait for a code.

A passkey cuts that to one tap and a glance. The UK's National Cyber Security Centre (NCSC) says passkey logins can be up to eight times faster than a username, password and two-step code. The FIDO Alliance's Passkey Index, based on data from nine large services including Amazon, PayPal and Target, found passkey sign-ins succeeded 93% of the time compared with 63% for other methods, and took 8.5 seconds on average against 31.2 seconds.

Those are big-platform figures, not small-shop ones, so don't expect the same numbers overnight. But the direction is clear: fewer failed logins means fewer abandoned baskets at the sign-in step. If you're working on checkout more broadly, our guide to optimising eCommerce checkout flows covers the other usual suspects.

How do passkeys stop account takeovers?

Most account takeovers start with a stolen or reused password. Someone's details leak from another site, a bot tries them on yours, and a customer's saved address and payment details are suddenly in the wrong hands.

Passkeys close most of those doors:

• They can't be phished. A passkey only works on the exact domain it was made for, so a fake login page can't collect it.
• They can't be reused. Every site gets its own unique passkey, so a breach elsewhere doesn't put your customers at risk.
• There's nothing worth stealing from you. Your database only holds public keys, which are useless to an attacker on their own.

In April 2026 the NCSC went further than before. It now recommends passkeys to the public and says businesses should offer them as the default way for consumers to sign in. It also quotes Google data showing just over half of active Google users in the UK already have a passkey registered. Your customers are more ready than you might think.

Passkeys don't replace the basics, though. Our post on website security fundamentals covers the rest.

What can Shopify, WooCommerce and OpenCart do today?

We checked each platform's current documentation on 22 October 2026. Here's where they stand.

Shopify

Shopify's customer accounts are already passwordless by default: the customer enters their email and gets a six-digit code. Passkeys come in through Sign in with Shop. If you have Shop Pay switched on, customers with a Shop account can sign in to your store and verify a Shop Pay checkout with their Shop passkey instead of an SMS code.

The catch is that the passkey belongs to the customer's Shop account, not to your domain. You can't currently register passkeys for your own store on the standard plans. On Shopify Plus you can connect your own identity provider, which could offer passkeys if your provider supports them.

What to do: move off legacy customer accounts (Shopify has deprecated them), keep Shop Pay on if it suits your store, and test the sign-in flow on a phone. See our Shopify development service if you need a hand.

WooCommerce

WordPress itself doesn't support passkeys yet. A proposal to add them to core is still awaiting review. So on WooCommerce, passkeys come from an extension.

There are now several, including one sold through the official WooCommerce.com Marketplace. The better ones add a passkey button to the My Account login and to checkout, let customers manage their passkeys from My Account, and give them recovery codes. On the newer block checkout, expect the passkey option to sit on the login page the checkout links to, then return the customer to checkout with their basket intact.

What to check before you install one: your PHP and WooCommerce versions meet its requirements, it works with your theme and checkout, and it keeps password login available. Test on a staging copy first. Our WooCommerce development team can help with the setup and testing.

OpenCart

OpenCart has no built-in passkey support, including the latest 4.1 release. We couldn't find a customer passkey extension in the OpenCart Marketplace either. The passwordless extensions we did find use SMS or email codes, which are better than passwords alone but can still be phished.

On OpenCart, passkeys are a custom extension: storing public keys against customer accounts, adding the sign-in and registration steps, and wiring them into the login and checkout pages. If you're also planning an upgrade, it makes sense to do it on OpenCart 4 rather than build it twice. Our OpenCart 3 to 4 upgrade guide and OpenCart development page explain how we approach both.

Custom builds (SvelteKit and FeathersJS)

On a custom build you have full control, which is where passkeys work best. WebAuthn is a standard browser API, so there's no third-party service to pay for or depend on.

We've built passkey login on FeathersJS and SvelteKit, and on that stack it looks like this:

• A passkey strategy in FeathersJS. Feathers ships with password, JWT and OAuth strategies. Passkeys are added as a custom strategy that checks the signed challenge against the stored public key, then issues the same session token as any other login.
• Passkey autofill in SvelteKit. With the right settings on the email field, saved passkeys appear in the browser's own autofill, so customers who have one just tap it. Customers who don't see a normal form.
• Passkey prompts at the right moment, such as straight after a first order, when the customer is happy and already signed in.

The same accounts can work in native iOS and Android apps too, so a customer who signs in on your website can use the same passkey in your app. See our SvelteKit development and FeathersJS development pages, or secure login and data protection for the full picture.

If you're still choosing a platform, our Shopify vs WooCommerce vs OpenCart comparison covers the wider trade-offs.

How do you add passkeys to your shop?

Whatever your platform, the steps are much the same:

1. Check you're on HTTPS everywhere. Passkeys won't work without it. See SSL certificates explained if you're unsure.
2. Offer passkeys, don't force them. Add "Sign in with a passkey" alongside your existing login, not instead of it.
3. Ask at the right time. Prompt customers to create a passkey after they've signed in or placed an order, not before they've bought anything.
4. Let customers manage them. A Passkeys section in My Account where they can see, name and remove each one.
5. Keep a fallback. An email code or magic link for anyone without a passkey, on a new device or in a browser that doesn't support them.
6. Watch the numbers. Track how many customers add a passkey and how many logins fail. That tells you whether it's working.

What are the common pitfalls?

Account recovery

When passkeys make logging in hard to attack, attackers turn to the "lost my device" route instead. The NCSC warns about exactly this. Make your recovery process at least as strong as your login: codes sent to a verified email, rate limits, and an alert to the customer when a passkey is added or removed. Synced passkeys help a lot here, because losing one phone doesn't usually mean losing the passkey.

Guest checkout

A passkey needs an account. Many customers will never make one, and that's fine. Keep guest checkout prominent and offer a passkey afterwards as a "save your details for next time" option. Never make account creation a condition of buying.

Shared devices

Passkeys assume one person per device. In a household where everyone uses the same tablet and knows the PIN, anyone can use a passkey saved on it. Make it easy to sign out, show who's signed in, and ask for a fresh check before changing addresses or payment details.

Browser and device support

Current versions of Chrome, Safari, Edge and Firefox all support passkeys, as do iPhones on iOS 16 or later and Android 9 or later. Older devices won't offer the option at all, so hide the passkey button when the browser can't use it. Windows PCs can save passkeys with Windows Hello, or customers can use a passkey on their phone by scanning a QR code.

Changing your domain

A passkey is tied to your domain. If you move from a .co.uk to a .com, or rebuild on a different domain, every customer's passkey stops working and they have to create a new one. Plan for it in any website migration, and keep login on one domain if you can.

Locking people out

Some extensions offer a "passkeys only" mode that hides the password form. Don't switch that on for customers. It's useful for staff accounts once everyone has registered a passkey, but customers need a way back in.

FAQ

What is passkey login?

Passkey login lets someone sign in with the fingerprint, face scan or PIN they use to open their phone or computer, instead of typing a password. The site stores only a public key, so there's no password to steal, reuse or phish.

Are passkeys safer than passwords and SMS codes?

Yes. The NCSC says passkeys are at least as secure as, and generally more secure than, the strongest password paired with two-step verification. Unlike SMS codes, they can't be phished on a fake site.

Can I add passkeys to my Shopify store?

Through Shop Pay, yes. Customers with a Shop account can use their Shop passkey to sign in and check out. You can't register passkeys on your own domain on the standard plans. Shopify Plus stores can connect their own identity provider.

Do I still need passwords or guest checkout?

Yes, for now. Keep a fallback sign-in, such as an email code, and keep guest checkout. Passkeys should be the quickest option, not the only one.

What happens if a customer loses their phone?

If their passkeys sync through Apple, Google or another password manager, they'll be on their new device once they sign in to that account. If not, they use your fallback sign-in and create a new passkey. That's why the fallback has to be secure.

How much does it cost to add passkeys?

It depends on your platform. On Shopify it's mostly settings. On WooCommerce it's an extension plus testing. On OpenCart and custom builds it's development work. Our secure login and data protection service starts from £395, and our care plans start from £49 a month if you'd like us to keep it updated.

The bottom line

Passkeys are ready for eCommerce. They're faster for returning customers, much harder to attack, and the UK's own cyber security authority now says businesses should offer them by default.

Start small: offer passkeys alongside your current login, ask at the right moment, and keep guest checkout and a solid fallback. If you'd like help adding passkeys to your shop, get in touch, we're happy to take a look.