FIDO2 / WebAuthn

FIDO2 is a suite of open authentication standards developed by the FIDO Alliance and the World Wide Web Consortium (W3C) that enables passwordless, phishing-resistant logins. Its core component is WebAuthn, a W3C web standard that defines a browser API allowing websites to integrate FIDO-based authentication. This standard allows users to authenticate using public-key cryptography via an authenticator device, such as a hardware security key (e.g., YubiKey), a smartphone, or a platform's built-in biometric sensor (e.g., Touch ID, Windows Hello).

The protocol operates on a challenge-response model. When a user registers with a service, their authenticator device generates a unique public-private key pair. The public key is sent to the server, while the private key remains securely stored on the device and never leaves it. During login, the server sends a cryptographic challenge, which the authenticator signs with the private key after user verification (via a PIN, fingerprint, or facial recognition). The server then verifies the signature with the stored public key, completing the authentication without transmitting a password or shared secret.

FIDO2's architecture provides significant security advantages over passwords. It eliminates risks associated with credential stuffing, phishing, and man-in-the-middle attacks because the private key is non-exportable and authentication is bound to the specific website's origin. Furthermore, it supports multi-factor authentication (MFA) in a single step, as the user's possession of the device (something you have) and their biometric or PIN (something you are/know) are verified simultaneously. This is often referred to as phishing-resistant MFA.

For developers, implementing FIDO2 involves integrating the WebAuthn API on the client side and the corresponding FIDO2 server components on the backend. Major browsers (Chrome, Firefox, Safari, Edge) and operating systems natively support WebAuthn. The standard is increasingly used for securing high-value accounts, enterprise single sign-on (SSO), and is a foundational technology for a passwordless future, reducing reliance on centralized password databases and improving the overall user authentication experience.

FIDO2 is a suite of open authentication standards, comprising the W3C Web Authentication (WebAuthn) API and the Client to Authenticator Protocol (CTAP), designed to replace passwords with more secure cryptographic logins. The core innovation is the use of public-key cryptography, where a unique cryptographic key pair is generated for each website or service. This eliminates the need for shared secrets like passwords, which are vulnerable to phishing, breaches, and reuse. The user's private key never leaves their secure device, while the public key is registered with the online service.

The authentication flow begins when a user attempts to log in to a relying party (e.g., a website). The site sends a cryptographic challenge to the user's browser via the WebAuthn API. The browser then communicates with a FIDO2 authenticator—which can be a platform authenticator like a device's built-in biometric sensor (Touch ID, Windows Hello) or a roaming authenticator like a hardware security key (YubiKey). The authenticator requires user verification, such as a fingerprint, PIN, or facial scan, to sign the challenge with the stored private key.

The signed response is sent back to the relying party, which verifies it using the previously registered public key. This process provides strong phishing resistance because the cryptographic signature is specific to the website's domain; a fake site cannot trick the authenticator. FIDO2 also supports two-factor authentication (2FA) by requiring both possession of the authenticator (something you have) and user verification (something you are or know). The protocol is designed to be privacy-preserving, as different key pairs are used for each service, preventing cross-site tracking.

The term FIDO2 originates from the Fast IDentity Online (FIDO) Alliance, a consortium founded in 2012 to reduce reliance on passwords. The '2' signifies the second major wave of specifications, which unified earlier efforts like U2F (Universal 2nd Factor) with a new, primary authentication method. WebAuthn (Web Authentication API) is the core W3C recommendation that provides the browser and web platform API for FIDO2. Its name directly describes its function: enabling web authentication via public key credentials.

The historical driver was the systemic failure of password-based security, plagued by phishing, breaches, and poor user hygiene. The FIDO Alliance's initial UAF (Universal Authentication Framework) and U2F standards laid the groundwork, with U2F proving particularly successful for two-factor authentication using physical security keys. FIDO2, officially launched in 2018, merged these concepts into a cohesive standard where WebAuthn handles the web API and the CTAP (Client to Authenticator Protocol) governs communication with external authenticators like security keys or biometric sensors on a device.

Adoption was accelerated by its endorsement as a W3C Recommendation in March 2019, giving it the official status of a web standard. Major browser vendors (Chrome, Firefox, Safari, Edge) and platforms (Windows Hello, Android, iOS) rapidly implemented support. This created a viable, phishing-resistant alternative to passwords for both two-factor and passwordless login flows, fundamentally changing the authentication landscape for developers and end-users.