What are FIDO2, WebAuthn and passkeys?
FIDO2 is a set of standards for logging in with public-key cryptography instead of a password; WebAuthn is the browser API half of it; a passkey is the credential it creates. Together they are what "passwordless" means in practice, and they are phishing-resistant by design.
How it works
At registration your device generates a key pair. The private key never leaves the device (or your synced keychain); the site stores only the public key. To sign in, the site sends a challenge, your device signs it after a local check (fingerprint, face, PIN, or a tap on a hardware key), and the signature proves possession. There is no shared secret to steal, phish or leak in a breach.
The pieces
| Term | What it is |
|---|---|
| FIDO2 | The umbrella: WebAuthn plus CTAP (the protocol to a hardware key) |
| WebAuthn | The W3C browser API; Level 3 was advancing toward full Recommendation in 2026 |
| Passkey | A FIDO2 credential — either synced across your devices (iCloud Keychain, Google, Microsoft) or bound to one hardware key |
| Hardware key | A physical device (e.g. a YubiKey) holding the private key in a secure element — the form used to meet NIST SP 800-63B AAL3 |
Why it matters now
NIST's finalised SP 800-63-4 (2025) and the US federal phishing-resistant-MFA mandate both name WebAuthn/FIDO2 specifically. Apple, Google and Microsoft ship passkeys by default. For regulated environments the hardware key remains the highest-assurance option.