FIDO2WebAuthn

FIDO2 WebAuthn is a framework for passwordless and phishing-resistant user authentication on the web. It is defined by the FIDO Alliance and the W3C. The FIDO2 family includes WebAuthn, a browser API for creating and using public-key credentials, and CTAP2, the protocol used by external authenticators to communicate with client devices. Together, they enable a relying party (a website) to register a user and later authenticate them without a password.

During registration, the user consents to create a new credential. The authenticator generates a new public-key/private-key pair, stores the private key securely, and the site stores the public key and other metadata. Authentication involves the server sending a challenge; the authenticator uses the private key to produce a signature over the challenge, which the server verifies with the stored public key. Attestation data may be used to convey device provenance, though users and sites can choose not to rely on it.

Authenticators can be platform-based (built into the operating system or device, such as Windows Hello, macOS, or Android native keys) or roaming (external security keys that connect via USB, NFC, or Bluetooth). WebAuthn credentials are bound to the origin (relying party) and can require user verification (e.g., biometric or PIN). This binding provides phishing resistance and reduces password reuse risks. Many browsers and platforms provide broad support, and passkeys and cloud-based credential backups are increasingly common.

Adoption considerations include recovery options, credential backups, and accessibility. Limitations include dependency on user devices and potential user friction in initial setup. Overall, FIDO2/WebAuthn aims to enable strong, interoperable passwordless authentication with a standards-based approach.