FIDOWebAuthn

FIDOWebAuthn, typically referred to as WebAuthn within the FIDO2 framework, is a web standard for passwordless and phishing-resistant authentication. It was developed through collaboration between the FIDO Alliance and the World Wide Web Consortium (W3C) and provides a standardized API and protocol for relying parties to register and authenticate users with public-key cryptography.

WebAuthn uses authenticators—devices or built-in components that securely hold private keys—to enable logins without shared passwords. A relying party is the service that wants to verify a user’s identity, while the user presents a credential stored on the authenticator. The public key is registered with the server during setup, while the private key remains on the authenticator and never leaves it. The protocol is paired with CTAP2, which enables external and platform authenticators to communicate with the user’s device.

Registration and authentication flows: During registration (MakeCredential), the user consents to create a new credential; the authenticator generates a new key pair, signs a challenge, and the service stores the public key and, optionally, attestation data. During authentication (GetAssertion), the service issues a challenge; the user proves possession of the private key by signing it, and the server verifies the signature using the registered public key. User verification (biometrics or PIN) can be required to unlock the private key.

Security and privacy: WebAuthn provides phishing resistance because authentication relies on domain-bound keys that cannot be phished. It reduces password reuse and credential theft, but losing an authenticator requires recovery or backup. Attestation data can disclose device information but can be limited to enhance privacy. Interoperability is a key goal across browsers and platforms, with ongoing updates and ecosystem support.

Adoption and impact: WebAuthn has broad browser support and is adopted by many identity providers and services as a primary method for passwordless login. It supports both platform authenticators (built into devices) and roaming authenticators (USB, NFC, Bluetooth).