🛡️WebAuthn

NEW

Also known as: Web Authentication

A W3C web standard enabling web applications to create and use strong, origin-bound public-key credentials for authentication.

DESCRIPTION

WebAuthn defines a browser API for registering and authenticating users with public-key credentials, providing phishing-resistant and passwordless authentication. It works with platform or roaming authenticators through CTAP2. Credentials are scoped to the relying party’s origin, and attestation can inform device trust. Supported by major browsers, WebAuthn underpins passkeys and modern MFA strategies, improving both security and user experience.

ALTERNATIVE DEFINITIONS

W3C

This specification defines an API that enables web applications to create and use strong, attested, scoped, public-key credentials.

Emphasizes strong, attested, origin-scoped credentials created via the web API.

Source

MDN Web Docs

The Web Authentication API (WebAuthn) allows servers to register and authenticate users using public key cryptography instead of passwords.

Developer-focused explanation highlighting passwordless authentication.

Source

FIDO Alliance

WebAuthn is a core part of FIDO2 enabling web-based creation and use of public key credentials.

Positions WebAuthn within the broader FIDO2 ecosystem.

Source

RELATED TERMS

FIDO2 CTAP2 Passkeys Public Key Infrastructure Origin-Bound Credentials Authenticator Attestation Credential Management API TLS 1.3 Phishing Resistance Multi-Factor Authentication

COMPETING TERMS

Password-based Authentication U2F

KNOWLEDGE AREAS

Data Security Software Engineering Platform & Tooling Data Privacy & Compliance

TARGET AUDIENCE

Software Developer Security Architect Cybersecurity Engineer UI-UX Designer Product Owner

EXTERNAL SOURCES

• Wikipedia - WebAuthn
• W3C - Official WebAuthn specification
• MDN Web Docs - WebAuthn API explanation
• Google Developers - Passkeys guidance and WebAuthn

TOP QUESTIONS

How does WebAuthn prevent phishing?

Credentials are bound to the relying party origin and verified via challenge–response, preventing reuse on fraudulent sites.

Category: Security

What authenticators work with WebAuthn?

Platform authenticators (e.g., device biometrics) and roaming hardware security keys via CTAP2 are supported.

Category: Definition

Is WebAuthn compatible across browsers?

Modern Chromium, Firefox, and Safari browsers support WebAuthn, though platform-specific features may vary.

Category: Requirements

What is attestation in WebAuthn?

Attestation provides cryptographic evidence about the authenticator model, aiding device trust and compliance decisions.

Category: Definition

What are common mistakes implementing WebAuthn?

Mishandling Base64URL encoding, failing to verify origins, and poor credential lifecycle management are frequent pitfalls.

Category: Mistakes

How does WebAuthn relate to passkeys?

Passkeys are user-friendly credentials built on WebAuthn, often synchronized across devices via platform keychains.

Category: Definition

Can WebAuthn replace passwords entirely?

Yes, WebAuthn enables passwordless flows, though backup and recovery strategies are critical for user experience.

Category: Opinion

How should teams roll out WebAuthn?

Start with optional enrollment, support both platform and roaming authenticators, educate users, and design strong recovery flows.

Category: Getting started

Does WebAuthn support MFA?

WebAuthn can act as a strong single factor or be combined with additional factors for MFA policies.

Category: Management