Voice biometrics is drawing increasing attention as it is a promising alternative to legacy passwords for user authentication. Recently, a growing body of work shows that voice biometrics is vulnerable to spoofing through replay attacks, where an adversary tries to spoof voice authentication systems by using a pre-recorded voice sample collected from a genuine user. To this end, we propose VoiceGesture, a liveness detection solution for voice authentication on smart devices such as smartphones and smart speakers. VoiceGesture detects a live user by leveraging both the unique articulatory gesture of the user when speaking a passphrase and the audio hardware advances on these smart devices. Specifically, our system re-uses a pair of built-in speaker and microphone on a smart device as a Doppler radar, which transmits a high-frequency acoustic sound from the speaker and listens to the reflections at the microphone when a user speaks a passphrase. Then we extract Doppler shifts resulted from the user's articulatory gestures for liveness detection. VoiceGesture is practical as it requires neither cumbersome operations nor additional hardware but a speaker and a microphone commonly available on smart devices that support voice input. Our experimental evaluation with 21 participants and different smart devices shows that VoiceGesture achieves over 99% and around 98% detection accuracy for text-dependent and text-independent liveness detection, respectively. Results also show that VoiceGesture is robust to different device placements, low audio sampling frequency, and supports medium range liveness detection on smart speakers in various use scenarios like smart homes and smart vehicles.