# WebAuthn / FIDO2

Source: https://startwithidentity.com/standards/webauthn-fido2/
Last updated: 2026-10-16
License: content by Start with Identity. Cite the source URL.

---

## What it is

WebAuthn is the W3C browser API for public-key authentication, and FIDO2 is the broader FIDO Alliance specification set (WebAuthn plus the CTAP protocol that talks to authenticators). Together they are the foundation of [passkeys](https://startwithidentity.com/guides/authentication/passkeys-101/) and hardware security keys, and they make [phishing-resistant authentication](https://startwithidentity.com/glossary/phishing-resistant-mfa/) practical at scale.

## How it works

Instead of a shared secret, the user's device holds a private key and registers a public key with the service. At login, the service sends a challenge, the authenticator signs it after a local user gesture (biometric or PIN), and the service verifies the signature.

- **Origin binding:** the credential is bound to the website's origin, so a phishing site cannot use it. This is the core security property.
- **No shared secret:** nothing reusable is transmitted or stored server-side, so there is nothing to steal in a breach.
- **Authenticators:** platform (Face ID, Windows Hello) or roaming (a [YubiKey](https://startwithidentity.com/vendors/mfa/yubico/)).

## Status

WebAuthn Level 3 became a W3C Recommendation on August 25, 2026, superseding Level 2 (2021). Passkeys, built on these standards, are now supported by every major operating system and browser, with billions of accounts enabled.

## When to use it

For any account where phishing and account takeover matter, which is most of them. Synced passkeys suit consumers; device-bound passkeys and hardware keys suit high-value and workforce use.

## Pitfalls

- Plan account recovery and enrollment carefully; these are the steps attackers target once passwords are gone.
- Support more than one authenticator per user, and have a tested fallback.

## Related

Guide: [Passkeys 101](https://startwithidentity.com/guides/authentication/passkeys-101/), [what is passwordless](https://startwithidentity.com/guides/fundamentals/what-is-passwordless/). Glossary: [FIDO2](https://startwithidentity.com/glossary/fido2/), [WebAuthn](https://startwithidentity.com/glossary/webauthn/), [passkey](https://startwithidentity.com/glossary/passkey/). Vendors: [MFA and passwordless](https://startwithidentity.com/vendors/mfa/).

## Who wrote it

The WebAuthn specification is edited by a group including [Tim Cappalli](https://startwithidentity.com/experts/tim-cappalli/) and [Emil Lundberg](https://startwithidentity.com/experts/emil-lundberg/), with [John Bradley](https://startwithidentity.com/experts/john-bradley/) a long-standing co-author across WebAuthn and FIDO2. The hardware lineage runs back to [Stina Ehrensvard](https://startwithidentity.com/experts/stina-ehrensvard/), who co-invented the YubiKey, and adoption was driven by the FIDO Alliance under [Andrew Shikiar](https://startwithidentity.com/experts/andrew-shikiar/). More in the [experts directory](https://startwithidentity.com/experts/).