What are FIDO2, WebAuthn and passkeys?
FIDO2 is a set of standards for logging in with public-key cryptography instead of a password; WebAuthn is the browser API half of it; a passkey is the credential it creates. Together they are what "passwordless" means in practice, and they are phishing-resistant by design.
How it works
At registration your device generates a key pair. The private key never leaves the device (or your synced keychain); the site stores only the public key. To sign in, the site sends a challenge, your device signs it after a local check (fingerprint, face, PIN, or a tap on a hardware key), and the signature proves possession. There is no shared secret to steal, phish or leak in a breach.
The pieces
| Term | What it is |
|---|---|
| FIDO2 | The umbrella: WebAuthn plus CTAP (the protocol to a hardware key) |
| WebAuthn | The W3C browser API; Level 3 was advancing toward full Recommendation in 2026 |
| Passkey | A FIDO2 credential — either synced across your devices (iCloud Keychain, Google, Microsoft) or bound to one hardware key |
| Hardware key | A physical device (e.g. a YubiKey) holding the private key in a secure element — the form used to meet NIST SP 800-63B AAL3 |
Why it matters now
NIST's finalised SP 800-63-4 (2025) and the US federal phishing-resistant-MFA mandate both name WebAuthn/FIDO2 specifically. Apple, Google and Microsoft ship passkeys by default. For regulated environments the hardware key remains the highest-assurance option.
Sources
- Web Authentication API - Web APIs | MDN (developer.mozilla.org) — "The Web Authentication API (WebAuthn) is an extension of the Credential Management API that enables strong authentication with public key cryptography, enabling passwordless authentication and secure multi-factor authentication (MFA) without SMS texts."
- Web Authentication: An API for accessing Public Key Credentials - Level 3 (w3.org) — "Note: Along with the Web Authentication API itself, this specification defines a request-response cryptographic protocol —the WebAuthn/FIDO2 protocol —between a WebAuthn Relying Party server and an authenticator , where the Relying Party ’s request consists of a challenge and other input data supplied by the Relying Party and sent to the authenticator ."