🔓FIDO2

NEW

An open set of standards enabling passwordless, phishing-resistant authentication using public-key credentials and authenticators.

DESCRIPTION

FIDO2 comprises the W3C WebAuthn specification and the FIDO Alliance’s CTAP2 protocol, enabling strong, phishing-resistant authentication without passwords. Credentials are origin-bound and stored on authenticators, enhancing security and user experience. FIDO2 supports platform authenticators (e.g., device biometrics) and roaming hardware keys. It underpins passkeys and is supported by major browsers and operating systems. Adoption reduces credential theft risks and improves compliance posture.

ALTERNATIVE DEFINITIONS

FIDO Alliance

FIDO2 enables users to leverage common devices to easily authenticate to online services in both mobile and desktop environments.

Highlights user-centric, cross-device authentication and passwordless design.

Source

W3C

This specification defines an API that enables web applications to create and use strong, attested, scoped, public-key credentials.

Focuses on the WebAuthn API enabling origin-bound public-key credentials.

Source

Microsoft Learn

FIDO2 allows users to sign in without a username or password by using an external security key or a platform key built into a device.

Explains enterprise deployment with platform and external authenticators.

Source

RELATED TERMS

WebAuthn CTAP2 Passkeys Asymmetric Encryption Authenticator Attestation U2F Multi-Factor Authentication Credential Management Platform Authenticator Roaming Authenticator

COMPETING TERMS

Password-based Authentication TOTP

KNOWLEDGE AREAS

Data Security Data Privacy & Compliance Software Engineering Platform & Tooling

TARGET AUDIENCE

Security Architect Cybersecurity Engineer Software Developer UI-UX Designer Product Owner Chief Information Security Officer Data Privacy Officer

EXTERNAL SOURCES

• Wikipedia - FIDO2 Project
• FIDO Alliance - CTAP and related specifications
• W3C - WebAuthn Level 2 spec
• Google Developers - Passkeys developer guidance

TOP QUESTIONS

What makes FIDO2 phishing-resistant?

Credentials are origin-bound and challenge-based, preventing credential replay across sites and resisting man-in-the-middle password capture.

Category: Security

How do FIDO2 passkeys work?

Passkeys are synchronized, device-bound credentials using platform authenticators and WebAuthn to provide seamless sign-in without passwords.

Category: Definition

What is the difference between platform and roaming authenticators in FIDO2?

Platform authenticators are built into devices (e.g., biometrics), while roaming authenticators are external hardware keys usable across devices.

Category: Comparison

What are common deployment challenges for FIDO2?

Ensuring browser and OS support, user education, credential lifecycle management, and integrating attestation policies can be challenging.

Category: Management

Is FIDO2 a replacement for MFA?

FIDO2 can be used as single strong authentication or part of MFA. It often provides stronger security than OTP-based MFA.

Category: Opinion

How does FIDO2 impact privacy compliance?

By reducing password risks and data exfiltration, FIDO2 improves security posture, supporting privacy-by-design and regulatory compliance.

Category: Compliance

What is the relationship between FIDO2 and WebAuthn?

FIDO2 includes WebAuthn (browser API) and CTAP2 (authenticator protocol), together enabling passwordless authentication.

Category: Definition

What are alternatives to FIDO2?

Password-based authentication and TOTP are common but more vulnerable to phishing and interception. FIDO2 offers stronger guarantees.

Category: Alternatives

How should teams start implementing FIDO2?

Pilot with WebAuthn libraries, support platform and security keys, plan credential recovery, and provide clear UX for enrollment and backup.

Category: Getting started