What is FIDO2 and WebAuthn?
Last updated: July 29, 2026
Definition
FIDO2 and WebAuthn are passwordless authentication standards enabling users to sign in using biometrics, PINs, or security keys instead of passwords. Developed by the FIDO Alliance and W3C, they use public-key cryptography to authenticate through possession factors (security keys, devices) or inherence factors (biometrics), eliminating phishing vulnerabilities in password-based systems.
Key Facts
- Also known as: Passkeys (consumer term for FIDO credentials), FIDO2 standard
- Category: Identity & Access Management
- Related standards/protocols: WebAuthn (W3C Recommendation 2019, Level 2 2021), CTAP (Client to Authenticator Protocol), FIDO U2F (predecessor)
- Key implementations: Windows Hello, Apple Touch ID/Face ID, Android biometrics, YubiKey, Google Titan Security Key, password managers (Bitwarden, Proton Pass)
- First standardized: 2013 (FIDO Alliance founded), 2019 (WebAuthn W3C Recommendation)
How FIDO2 and WebAuthn Work
FIDO2 combines two components: WebAuthn (the browser API managing cryptographic authentication) and CTAP (the protocol connecting clients to authenticators). When a user registers, the authenticator generates a unique public-private key pair bound to that specific web domain. The private key never leaves the device. The public key is sent to the relying party and stored server-side.
During sign-in, the relying party sends a challenge to the client. The authenticator signs this challenge with the private key, and the client returns the signed response. The relying party verifies the signature using the stored public key, confirming possession of the correct authenticator without transmitting the private key, a process that security operations monitoring systems track for anomaly detection.
FIDO2 supports two authenticator types. Roaming authenticators are portable hardware keys connecting via USB, NFC, or Bluetooth, usable across multiple devices. Platform authenticators are built into devices like Windows Hello or Touch ID and remain device-bound. Both perform user verification through biometrics or PINs, achieving multi-factor authentication in a single step.
Why FIDO2 and WebAuthn Matter
Password-based authentication remains the primary attack vector for credential theft and phishing. FIDO2 eliminates these vulnerabilities by replacing shared secrets with cryptographic proof of possession tied to specific domains. Attackers cannot phish credentials that never traverse the network, and server breaches cannot expose private keys that never leave user devices.
Organizations implementing FIDO2 report a 92% reduction in authentication-related support tickets and an 84% decrease in password reset costs (Academic research, 2024-2025). Consumer adoption is accelerating, with 53% of users enabling passkeys on at least one account (FIDO Alliance, 2024). Major platforms including Google, Microsoft, Apple, and Discord have deployed FIDO2 authentication, now supported across 85% of devices globally. For IT teams managing authentication infrastructure, FIDO2 provides a phishing-resistant standard that scales across web, mobile, and enterprise applications, aligning with zero trust security implementations that verify every access attempt cryptographically.
FIDO2 vs. Traditional Multi-Factor Authentication
| Aspect | FIDO2 | Traditional MFA |
| Primary function | Passwordless authentication using cryptographic keys | Password + secondary factor (OTP, SMS) |
| Scope | Single-step phishing-resistant authentication | Two-step password-based authentication |
| Used by | Web/mobile apps requiring phishing resistance | Organizations adding security to passwords |
| Key difference | Domain-bound credentials prevent phishing | Passwords and OTPs vulnerable to phishing |
| When to use | Eliminating password vulnerabilities entirely | Adding security without infrastructure changes |
FIDO2 replaces passwords with domain-bound cryptographic credentials, while traditional MFA adds a second factor to password authentication that remains vulnerable to phishing.
Common Misconceptions
FIDO2 and WebAuthn are not the same technology. WebAuthn is the browser API component of the FIDO2 standard, which also includes the CTAP protocol for authenticator communication.
Biometric data is not transmitted to servers during FIDO2 authentication. Biometrics remain on the local device and only unlock the private key, which then performs cryptographic authentication without ever exposing biological data.
Frequently Asked Questions
FIDO2 credentials are cryptographically bound to specific web domains. When attackers create phishing sites, the authenticator recognizes the different domain and refuses authentication since no matching key pair exists for that origin.
Hardware-bound credentials stay permanently on security keys, providing attestation certificates proving specific security properties to high-security relying parties like banks and financial services IT infrastructure requiring guaranteed device-bound keys. Syncable passkeys enable backup and multi-device sync but sacrifice attestation guarantees and some enterprise security features.
Security keys require physical connection via USB, NFC, or Bluetooth plus touch for proof of presence. Platform authenticators use device biometrics or PINs, with credentials bound to that device requiring separate enrollment per device.
