Passkeys / FIDO2 / WebAuthn
Passwordless authentication based on public-key cryptography, delivered through WebAuthn (W3C) and CTAP (FIDO).
Overview
Passkeys implement passwordless login using public-key cryptography. Users authenticate with a device-bound credential and local user verification (biometric or PIN), via the WebAuthn API and CTAP protocols.
How it works
- Registration: Site asks for a new credential via WebAuthn; an authenticator creates a key pair and returns a public key + attestation.
- Authentication: Site sends a challenge. Authenticator signs it with the private key after local user verification.
- Device portability: Platform sync or roaming authenticators (security keys) enable use across devices in line with vendor policies.
Common use cases
- Consumer sign-in replacing passwords
- Workforce phishing-resistant MFA
- Step-up auth for high-risk transactions
- Zero-trust endpoint access
- Privileged-account and administrative access
Strengths and limitations
Strengths: Phishing resistance; no shared secrets; fast UX.
Limitations: Cross-ecosystem portability; attestation policy; account recovery patterns.
Key terms
- WebAuthn: W3C API for creating/using credentials.
- CTAP: FIDO protocol between client and authenticator.
- Attestation: Evidence about the authenticator model/security.
Current market signal
Passkeys and FIDO credentials are expanding from consumer sign-in into national identity and enterprise authentication. Singpass adoption and Microsoft's Entra migration timeline show large identity platforms moving phishing-resistant credentials from an option toward a default.
References
Vendors using Passkeys / FIDO2 / WebAuthn
Latest Data Cards
Data Card Nexiden sues Ping Identity over mobile authentication patents
2026-08-21CC-BY-4.0digital-idpasskeys-webauthnNexiden filed a patent infringement suit against Ping Identity in Texas federal court over two patents covering secure mobile device registration and session-based authentication.
- The asserted patents are US 9,521,548 and US 10,592,872, covering on-device private keys paired with local biometric authentication.
- Nexiden says licensing approaches in March 2023 and September 2024 did not succeed; the target is the PingID app.
- Nexiden seeks an injunction plus damages for past and ongoing infringement.
Data Card Yubico ships YubiKey firmware 5.8 with hardware-backed signing
2026-07-21CC-BY-4.0passkeys-webauthnYubico released YubiKey firmware version 5.8, adding CTAP 2.3 support and a preview of the WebAuthn signing extension for hardware-backed approvals.
- Firmware 5.8 supports CTAP 2.3 and a preview of the WebAuthn signing extension.
- Hardware-backed signing targets transaction approvals, AI agent authorizations, and payment confirmations.
- Enterprise Attestation supports up to 16 relying-party identifiers.
Data Card Microsoft sets Entra passkey default and SMS retirement timeline
2026-07-15CC-BY-4.0passkeys-webauthnMicrosoft set a phased timeline to make passkeys the default Entra ID experience for users enabled for SMS or voice and to retire Microsoft-provided telecom authentication.
- On September 1, 2026, in-scope users will be enabled and prompted to register passkeys.
- Microsoft-provided SMS and voice delivery retires for public-cloud Entra ID on February 1, 2027.
- Organizations with a continuing operational need can use a customer-managed telecom provider, while Microsoft recommends phishing-resistant methods as the primary path.