Back to glossary

WebAuthn

A web standard published by the W3C that allows for passwordless authentication using public-key cryptography.

Categorysecurity

Overview

WebAuthn (Web Authentication) is a core component of the FIDO2 project. It is a browser-based API that allows web applications to use built-in authenticators (like Windows Hello, Touch ID, or Face ID) or external security keys for secure login.

How it Works

  1. The website sends a challenge to the browser.
  2. The browser asks the user to authenticate (e.g., via fingerprint).
  3. The authenticator signs the challenge with a private key stored on the device.
  4. The browser sends the signature back to the website, which verifies it with the user's public key.

Benefits

  • Passwordless: Users don't need to remember or type passwords.
  • Phishing-Resistant: The authentication is cryptographically bound to the website's origin.

Related Terms

FIDO2Biometric Authentication