FIDO2 and WebAuthn explained: the standards behind passkeys

FIDO2 is a set of open standards that replace passwords with cryptographic key pairs. It consists of WebAuthn, an interface that websites call in your browser, and CTAP, the protocol that lets the browser talk to an authenticator such as a phone or a USB security key. Together they are what makes passkeys work.

What FIDO2 and WebAuthn are for

Passwords can be guessed, reused, leaked and phished. FIDO2 removes the shared secret: instead of sending a password the site could lose, you prove that you hold a private key that never leaves your device. The FIDO Alliance (an industry group, see fidoalliance.org) develops CTAP and the certification programmes, and the World Wide Web Consortium (W3C) publishes WebAuthn.

The standards support passwordless login, second-factor login and, with a fingerprint or PIN on the authenticator, multi-factor login in a single step.

The roles

Role	What it does	Example
Relying party	The website or service that wants to log you in	A bank, an email provider
Client	The browser or app that calls WebAuthn	Firefox, Chrome, Safari, Edge
Authenticator	Holds the private keys and signs challenges	Phone, laptop chip, password manager, YubiKey, Nitrokey
User	Approves with biometrics or a PIN (“user verification”)	You

How registration and login work

Registration (once per site):

1. You choose “Create passkey” at the site.
2. The site sends a random challenge and its identifier, for example example.com.
3. The browser passes the request to the authenticator, which asks you to confirm with a fingerprint, face or PIN.
4. The authenticator creates a new key pair just for this site and returns the public key with a credential ID.
5. The site stores the public key. Nothing secret is stored.

Login (every time):

1. The site sends a new challenge.
2. The browser checks that the site matches the one the credential was created for.
3. You confirm locally.
4. The authenticator signs the challenge with the private key.
5. The site verifies the signature with the stored public key and signs you in.

A trimmed registration request, as the site passes it to the browser, looks like this:

{
  "challenge": "dGhpcyBpcyBhIHJhbmRvbSBjaGFsbGVuZ2U",
  "rp": { "id": "example.com", "name": "Example" },
  "user": { "id": "dXNlci00NzEx", "name": "[email protected]" },
  "pubKeyCredParams": [{ "type": "public-key", "alg": -7 }],
  "authenticatorSelection": { "residentKey": "required", "userVerification": "preferred" }
}

Passkeys, synced and device-bound

A discoverable credential (also called resident key) lets the authenticator remember the account, so you do not even type a username. This is what a passkey is. Passkeys can be synced through a platform or a password manager, which helps recovery, or device-bound, for example on a hardware key. The trade-offs are covered in hardware security keys.

Everyday examples

• Tapping “Sign in with a passkey” on a shop and approving with your fingerprint.
• Plugging in a security key and touching it to unlock a work account.
• Your phone approving a login on a nearby computer through a QR code and Bluetooth proximity check.
• A bank using a security key for high-risk actions.

Security aspects

• Phishing resistance. The credential is bound to the real origin, so fake sites receive nothing usable. This is why FIDO2 is the reference for phishing-resistant MFA.
• No shared secrets. A breach at the site exposes only public keys.
• Local biometrics. A fingerprint or face scan never goes to the site, see biometric login.
• Recovery is the weak point. Lose all authenticators without a backup and you depend on the site’s recovery process, which attackers target. Register at least two authenticators.
• Attestation and privacy. Authenticators can optionally prove their make and model. Sites should request this only when policy needs it, since it can identify device types.
• Sync trust. A synced passkey is as safe as the account and recovery of the provider that syncs it.

Status and versions

WebAuthn Level 1 appeared in 2019 and Level 2 became a W3C Recommendation in April 2021. Level 3 became a W3C Recommendation on 25 August 2026, according to the FIDO Alliance announcement. It adds, among other features, conditional mediation (the passkey suggestion in username fields), backup eligibility and state flags, a Signals API that lets sites tell credential managers when a passkey is stale, related origin requests so one passkey can serve a small set of related domains, and a PRF extension for key derivation. CTAP 2.x is maintained by the FIDO Alliance, and a list of current specifications is at fidoalliance.org/specifications.

How it relates to the other standards

FIDO2 handles the question “is this the same device and person as at registration?” It does not carry attributes such as your name. It pairs well with OpenID Connect: an identity provider can use a passkey to authenticate you and then issue an ID token to other applications. Compared with SAML, OIDC and OAuth, which move assertions between parties, FIDO2 is the login method underneath.

Role in the EUDI Wallet

The EU Digital Identity Wallet is not a FIDO2 product, and its credential exchange uses OpenID4VCI and OpenID4VP instead. The two meet in practice: a wallet app is typically unlocked with the phone’s biometrics or PIN, the same kind of user verification that FIDO2 uses, and services may let you sign in with a passkey while using the wallet only for steps that need verified attributes, such as proving your age or opening a bank account.