Tools · SPBoucher
Menu

Web Authentication (WebAuthn)

by W3C Web Authentication Working Group (with the FIDO Alliance) · Specification · also known as WebAuthn, Web Authentication API, FIDO2 WebAuthn

W3C standard defining the browser API for creating and using public-key credentials, the basis of passkeys and FIDO2 hardware-key authentication

Open sourceFreeLocal
Visit official site Compare

Checked Nov 2, 2026

Overview

Web Authentication is a W3C specification, developed by the Web Authentication Working Group in coordination with the FIDO Alliance, that defines a JavaScript API through which web applications ask the browser to create and use public-key credentials bound to an origin. Level 2 became a W3C Recommendation in 2021 and Level 3 reached Recommendation status on 25 August 2026. Together with the FIDO Alliance's Client to Authenticator Protocol (CTAP), which governs how browsers talk to security keys and phones, it forms FIDO2.

A relying party sends a challenge; the authenticator, whether a platform authenticator such as Touch ID or Windows Hello or a roaming key such as a YubiKey, signs it with a private key that never leaves the device, and the server verifies the signature against the stored public key. Credentials are scoped to the origin, which defeats phishing, and discoverable credentials synchronized across a user's devices are what consumer platforms market as passkeys. Server-side libraries exist for most languages, identity providers such as Keycloak and authentik implement it, and password managers like 1Password act as authenticators.

Adoption still depends on browser, operating-system and authenticator support for individual features, on account-recovery design when devices are lost, and on relying parties implementing attestation and user verification policies correctly.

Editorial note on uncertainty. license_spdx omitted: the specification text is under the W3C Document License, which is not a software license.

Capabilities

  • Origin-bound public-key credential creation and assertion through the browser
  • Platform and roaming authenticators (biometrics, PINs, security keys)
  • Discoverable, synchronized credentials (passkeys) and multi-device credentials
  • Attestation formats and user-verification requirements for relying parties
  • Extensions such as PRF for deriving secrets

Typical workflows

  1. Add passwordless or second-factor login to a web application with a server library
  2. Enable passkeys in an identity provider for all federated applications
  3. Require hardware keys for administrative accounts

Strengths

  • Phishing-resistant by construction through origin binding
  • Supported by all major browsers and operating systems
  • Royalty-free open standard

Limitations

  • Feature support varies across browsers, platforms and authenticators
  • Account recovery must be designed separately
  • Attestation and policy handling add server-side complexity

Prerequisites

  • HTTPS origin
  • A server-side library to verify registrations and assertions

Who it is for

  • Web developers implementing authentication
  • Identity and security architects

Alternatives & comparison

WebAuthn is a specification rather than a product; Keycloak and authentik are identity providers that implement it, and 1Password and other password managers act as passkey authenticators. Listing them as alternatives reflects the different ways a team adopts the standard.

  • 1Password

    Password and secrets manager for individuals, families and businesses with end-to-end encrypted vaults, passkeys, an SSH agent and a developer CLI

    ProprietaryPaid
  • authentik

    Self-hosted identity provider with OIDC, SAML, LDAP, RADIUS and SCIM support and a built-in application proxy, with an MIT core and an enterprise edition

    MixedOpen source
  • Keycloak

    Open-source identity and access management server providing single sign-on with OpenID Connect, OAuth 2.0 and SAML, user federation and fine-grained authorization

    Open sourceOpen source
Compare Web Authentication (WebAuthn) with its alternatives →

Sources & verification

Primary sources consulted for this record. Claims are tied to the fields each source supports; the automated link checker re-verifies every URL on a schedule.

Confidence
High
Reviewed
Nov 1, 2026
Links
Broken · Nov 2, 2026

Spotted an error?

Broken link, outdated license, wrong category, or a tool that no longer exists? Tell us; reports are reviewed by the editor.

Bitwarden

Bitwarden Inc. · Secrets management

Open-source password manager with hosted and self-hosted server options, passkey support, organization sharing and a separate Secrets Manager for developers

AGPL-3.0-onlyFreemiumPaidLocalSelf-hostedNov 2, 2026