Passwordless X1280
Passwordless X1280 integrates WordPress with the X1280 Passwordless Authentication Server, enabling secure passwordless login through the biometric capabilities already built into your users’ smartphones — Face ID and fingerprint recognition — based on the ITU-T X.1280 international standard.
Forget passwords, password resets, and phishing risks. Instead of asking users to type a password, your site presents an automatic password that users simply verify and approve in the Passwordless X1280 mobile app.
Why Passwordless X1280?
- Built on the ITU-T X.1280 international standard – a globally recognized passwordless authentication framework designed for the zero-trust era.
- Mutual authentication – users verify the service before authenticating, helping prevent phishing and fraudulent login pages.
- Smartphone-based biometrics – authenticate securely with Face ID or fingerprint recognition, even when the computer itself has no biometric hardware (out-of-band authentication).
- No additional hardware required – works with existing smartphones and browsers; no security keys or dedicated sensors to buy.
- Free for B2C online services – provided by the non-profit Passwordless Alliance to promote safer digital services worldwide.
How It Works
Unlike traditional login systems where only the user is authenticated, X.1280 introduces mutual authentication:
- The WordPress login page displays a unique auto-password.
- The user checks that the same auto-password appears in the Passwordless X1280 mobile app.
- After confirming the service identity, the user approves the login with smartphone biometrics.
- Authentication completes securely — no password is typed or transmitted.
This ensures users are communicating with the legitimate website before any authentication takes place.
Key Features
- Adds a Password / Passwordless login option to
wp-login.php - Secure WebAuthn / passkey-based authentication
- Admin settings panel for X1280 server configuration
- Option to disable password-based login entirely
- Uses WordPress hooks only — no core file modifications
- Compatible with multisite environments
- Works alongside caching and security plugins
Automatic Page Creation
Upon activation, the plugin automatically creates the following pages:
- Passwordless X1280 Login Page – displays the passwordless login interface using the
[px1280_login]shortcode - Passwordless X1280 Register / Unregister Page – lets users register and manage passkeys using the
[px1280_manage]shortcode
Both pages can be edited or reassigned from the WordPress admin panel if needed.
Security
- No passwords are transmitted during passwordless authentication
- Out-of-band approval on a separate trusted device (the user’s smartphone)
- Uses WordPress nonces and secure server-side verification
- Requires HTTPS (a WebAuthn requirement)
- Does not modify WordPress core files
Requirements
- A WordPress site served over HTTPS
- Users need a smartphone with the free Passwordless X1280 mobile app (App Store / Google Play)
- A Server Key for the X1280 Authentication Server (see the FAQ for how to obtain one)
External Services
This plugin connects to an external service to enable passwordless authentication.
- Service name: X1280 Authentication Server
- Service URL: http://wp-x1280.dualauth.com
- Service provider: Passwordless Alliance
Purpose: the service processes passwordless authentication requests using WebAuthn (passkeys).
Data sent:
- Username (userId)
- Authentication session data (token, random, sessionId)
- Server key (for verification)
Data received:
- Authentication result (approved / denied)
- Service password (OTP)
- Push notification data
When data is sent:
- During login (passwordless authentication)
- During registration / unregistration of passkeys
About the Passwordless Alliance
The Passwordless Alliance is a non-profit organization headquartered in Geneva that distributes Passwordless X1280 software free of charge to B2C online services worldwide. The underlying technology is standardized by the ITU-T as Recommendation X.1280.