WebAuthn

WebAuthn, short for Web Authentication, is a web standard developed by the World Wide Web Consortium (W3C) in collaboration with the FIDO Alliance. It defines an API for creating and using public-key credentials in the browser, enabling passwordless logins and phishing-resistant two-factor authentication, with support for built-in platform authenticators and external security keys.

Registration: the user creates a credential via a relying party (the website). The authenticator generates a public/private key pair, storing the public key and metadata with the server while the private key remains on the device. Authentication: the server issues a challenge; the authenticator signs it with the private key to produce an assertion verifiable against the stored public key, with user verification (PIN or biometric) potentially required.

WebAuthn emphasizes origin-bound credentials, reducing credential theft and phishing because private keys do not leave the authenticator and assertions are tied to the site origin. Attestation may accompany credentials, which can raise privacy considerations, and many deployments treat attestation as optional. Policies may require user verification for higher security.

Support and adoption: WebAuthn is implemented in major browsers, including Chrome, Edge, Firefox, and Safari, and is supported on platforms such as Windows Hello, macOS biometric authentication, and Android. It is widely used for passwordless logins and as a second-factor method.

Relation to standards: WebAuthn is part of FIDO2 and works with CTAP for communication with authenticators. The WebAuthn API provides JavaScript interfaces for credential creation and assertion retrieval, while CTAP handles the hardware interaction. The standard is maintained by the W3C and the FIDO Alliance.