W3C-WEBAUTHN-WG

W3C WebAuthn WG passwordless API.

Definition

WebAuthn API main: navigator.credentials.create() (registration), navigator.credentials.get() (authentication), CTAP (Client to Authenticator Protocol) v2 underlying, COSE (CBOR Object Signing and Encryption) key formats. Authenticator types: Roaming Authenticators (YubiKey, Titan Security Key, Feitian USB/NFC), Platform Authenticators (Face ID iOS, Touch ID macOS, Windows Hello). Passkeys (consumer terminology) = WebAuthn implementation in operating system credential manager (iCloud Keychain, Google Password Manager, 1Password). Co-developed with FIDO Alliance (Fast IDentity Online, founded 2013).

Origin

WebAuthn Level 1 published W3C Recommendation 4 March 2019 ; Level 2 published 8 April 2021 ; Level 3 W3C Editor Draft ongoing 2024 ; co-developed W3C + FIDO Alliance since 2016.

Example in context

Google Workspace deploys WebAuthn passkeys 2023: 200M users can sign in via Face ID iPhone, Touch ID Mac, Windows Hello without password ; 90% phishing attack reduction.

Related terms

• FIDO2 — underlying standard.