CredentialManagement

Credential management refers to the systems and interfaces that store, manage, and retrieve user credentials, such as usernames, passwords, tokens, and cryptographic keys. The goal is to improve security and user experience by enabling safe storage, autofill, and reuse across apps and services while reducing insecure practices like password reuse. In web environments, credential management spans browser-integrated password managers, operating system vaults, and standardized application programming interfaces that coordinate between sites and identity providers.

The Credential Management API is a W3C standard that provides a consistent interface for web applications to interact with credential stores. It supports several credential types, including PasswordCredential for username-password pairs, FederatedCredential for third-party identity providers, and PublicKeyCredential used by WebAuthn for passwordless and phishing-resistant sign-in. Core operations include storing credentials (store), retrieving credentials (get), and managing user consent (prompting the user) and privacy (preventSilentAccess).

Usage patterns typically involve a user creating an account or logging in on a site, with the site initiating a store() call to save a credential or a get() call to request a matching credential. The browser or OS may prompt the user to confirm saving, and later visits allow automatic or assisted filling. Federated credentials and WebAuthn tokens enable passwordless or phishing-resistant sign-in, though adoption varies by platform and site.

Security considerations: The API relies on explicit user consent and secure channels. It can reduce password reuse and phishing risk when used with modern authentication methods, but it expands the trust boundary to include the browser and OS credential store. Developers should require HTTPS, adhere to least privilege, and design obvious, privacy-preserving prompts.

Relation to broader standards: Credential management is associated with W3C specifications for the Credential Management API and with identity technologies such as WebAuthn and FIDO2. It complements traditional password managers and platform-specific vaults, rather than replacing them.