Passkeys / FIDO2 / WebAuthn
Passwordless authentication based on public-key cryptography, delivered through WebAuthn (W3C) and CTAP (FIDO).
Overview
Passkeys implement passwordless login using public-key cryptography. Users authenticate with a device-bound credential and local user verification (biometric or PIN), via the WebAuthn API and CTAP protocols.
How it works
- Registration: Site asks for a new credential via WebAuthn; an authenticator creates a key pair and returns a public key + attestation.
- Authentication: Site sends a challenge. Authenticator signs it with the private key after local user verification.
- Device portability: Platform sync or roaming authenticators (security keys) enable use across devices in line with vendor policies.
Common use cases
- Consumer sign-in replacing passwords
- Workforce phishing-resistant MFA
- Step-up auth for high-risk transactions
- Zero-trust endpoint access
- Privileged-account and administrative access
Strengths and limitations
Strengths: Phishing resistance; no shared secrets; fast UX.
Limitations: Cross-ecosystem portability; attestation policy; account recovery patterns.
Key terms
- WebAuthn: W3C API for creating/using credentials.
- CTAP: FIDO protocol between client and authenticator.
- Attestation: Evidence about the authenticator model/security.
Current market signal
Passkeys and FIDO credentials are expanding from consumer sign-in into national identity and enterprise authentication. Singpass adoption and Microsoft's Entra migration timeline show large identity platforms moving phishing-resistant credentials from an option toward a default.
References
Vendors using Passkeys / FIDO2 / WebAuthn
Latest Data Cards
Data Card Microsoft sets Entra passkey default and SMS retirement timeline
2026-07-15CC-BY-4.0passkeys-webauthnMicrosoft set a phased timeline to make passkeys the default Entra ID experience for users enabled for SMS or voice and to retire Microsoft-provided telecom authentication.
- On September 1, 2026, in-scope users will be enabled and prompted to register passkeys.
- Microsoft-provided SMS and voice delivery retires for public-cloud Entra ID on February 1, 2027.
- Organizations with a continuing operational need can use a customer-managed telecom provider, while Microsoft recommends phishing-resistant methods as the primary path.
Data Card Singpass begins passkey rollout for national digital ID login
2026-06-30CC-BY-4.0passkeys-webauthndigital-idmobile-idSingapore's GovTech began rolling out passkeys for Singpass, replacing phishable sign-in steps with cryptographic credentials unlocked by local device biometrics or a passcode.
- The rollout began with eligible iOS users able to create a passkey from July 1, 2026.
- The private key remains on the user's device while Singpass stores the corresponding public key.
- Setting up Singpass on a replacement device automatically deactivates the app and passkey on the lost or previous device.
Data Card WebComm and ASUS launch FIDO-based Zero Trust PC for Thailand
2026-06-24CC-BY-4.0passkeys-webauthndigital-idWebComm and ASUS introduced a FIDO-based Zero Trust PC for Thailand, tying device-level access controls to passwordless authentication and enterprise identity assurance.
- The product positions FIDO authentication as a hardware-level control inside an enterprise endpoint.
- The Zero Trust framing links device trust, identity verification, and secure access policy.
- The launch reflects growing use of passkey and WebAuthn standards beyond consumer sign-in flows.