Field Notes

entity

WebAuthn

StatusStableReviewdue UpdatedStands on4 sourcesSupportsnotes

WebAuthn — formally Web Authentication: An API for accessing Public Key Credentials — is the W3C specification that defines the browser-facing half of FIDO2. It was developed jointly by the W3C Web Authentication Working Group and the FIDO Alliance, and it gives web applications two ceremonies: creating a public-key credential on an authenticator, and later proving possession of it. Level 1 became a W3C Recommendation in March 2019 and Level 2 in April 2021; Level 3 was a Candidate Recommendation Snapshot on 26 May 2026, with the W3C proposing advancement to full Recommendation on 21 July 2026.1

The two ceremonies

A web application calls navigator.credentials.create() to register. The browser collects the relying party’s parameters, passes them to an authenticator, and returns a new credential: a public key, a credential identifier, and optionally an attestation statement. Sign-in calls navigator.credentials.get(), which asks the authenticator to sign a fresh challenge with the private key. Both ceremonies are mediated by the browser, which enforces the origin binding before any authenticator is touched.2

What the relying party learns is a public key, not a shared secret. There is nothing password-shaped on the server to steal in a database breach, and nothing reusable for the user to type into the wrong site. The credential is scoped to the relying party identifier, derived from the origin, so a credential created for one site is cryptographically unusable at a lookalike domain — the origin binding is what makes WebAuthn credentials phishing-resistant.

Presence, verification, and the authenticator model

WebAuthn distinguishes user presence from user verification. Presence is a consent gesture — a touch on a security key — proving a person was there. Verification is a stronger check that the same person returned, via a PIN or a biometric evaluated on the authenticator. The biometric or PIN never crosses the wire: the service receives only a flag in the signed assertion saying verification happened. This keeps biometric templates out of server databases entirely, at the cost of trusting the authenticator’s self-report.

Authenticators come in two form factors. Platform authenticators are built into the device — Windows Hello, Android’s and Apple’s biometric unlock systems — and roam with the account rather than the hardware. Roaming authenticators are removable tokens such as security keys, which the platform reaches over the CTAP protocol via USB, NFC, or Bluetooth.

Passkeys and synced credentials

WebAuthn supports discoverable credentials, which the authenticator stores and can enumerate without a credential-identifier hint. Platform vendors turned this into passkeys from 2022: discoverable credentials synced across a user’s devices through the platform account, recoverable when a phone is replaced. The protocol is unchanged; what changed is that the credential moved from something a key holds to something an ecosystem syncs, trading the strict device-binding of a hardware key for usability and recovery. Level 3 extends this model further with related-origin requests and richer extension plumbing.1

Status and governance

WebAuthn is versioned in levels by the W3C, while the authenticator protocol it invokes is versioned separately by the FIDO Alliance as CTAP. The two tracks are coordinated but independent: a browser can ship a new WebAuthn level against older CTAP authenticators, and a new CTAP version can add authenticator features no WebAuthn level yet exposes. The vault treats WebAuthn as an entity because the W3C owns and versions the document, in the same way Messaging Layer Security belongs to its standards body rather than to the idea of group encryption.

  1. W3C, Proposed advancement of WebAuthn Level 3 to W3C Recommendation, 21 July 2026. ↩↩

  2. W3C, Web Authentication: An API for accessing Public Key Credentials, Level 3. ↩

Built on 4 sources (4 external).

Working out connections…