WebAuthn Level 3 is a W3C Recommendation, and it standardises the parts everyone already shipped

The W3C published Web Authentication Level 3 as a Recommendation on August 25, 2026, with the FIDO Alliance announcing it at the end of the month. Level 3 formalises capabilities browsers and platforms had already deployed against working drafts. Conditional create lets a site silently upgrade a user from a password to a passkey during an ordinary sign-in, and conditional get drives the autofill picker. The Backup Eligible and Backup State flags let a relying party distinguish a synced passkey from a device-bound one, and see its current backup status. The Signals API gives sites a way to coordinate lifecycle events, notably revocation and renaming, which credential managers previously had no way to learn about. Related Origin Requests allow one passkey to work across related domains, the PRF extension derives stable per-credential key material, and AAGUID without attestation lets a site label a passkey by the manager that holds it.

Why it matters

Recommendation status does not change what your browser can do this week. It changes what you can build a policy on. Until now, an enterprise writing a passkey standard had to cite working drafts that could still move, which is a poor foundation for an authentication policy and an actively bad one for an auditor.

Two items matter more than the rest in practice. The Signals API is the first standard answer to the revocation problem that has dogged every passkey rollout: when an account is closed or a credential is removed server-side, the passkey previously sat in the user's credential manager forever, offering to sign them in to something that no longer exists. And conditional create is the migration lever, because it converts passkey adoption from a task a user has to choose into a by-product of a login they were doing anyway. Given that enrollment is where the attacks moved once the cryptography held, a standardised enrollment path with defined semantics is worth more than it looks.

Source: FIDO Alliance