iOS 16 - Wikipedia
iOS 16 is the sixteenth major release of Apple's iOS mobile operating system for the iPhone. It is the successor of iOS 15, and was announced at the ...
WebAuthn
Passkeys allows the user to authenticate to services that implement <anchor>WebAuthn</anchor> across their devices without using passwords. Passkeys are generated by the phone and permission is granted via Face ID or Touch ID.[15]
WebAuthn - Wikipedia
WebAuthn - Wikipedia[Jump to content](#bodyContent)

Main menu

Main menu

move to sidebarhide

Navigation


- [Main page](/wiki/Main_Page "Visit the main page [z]")
- [Contents](/wiki/Wikipedia:Contents "Guides to browsing Wikipedia")
- [Current events](/wiki/Portal:Current_events "Articles related to current events")
- [Random article](/wiki/Special:Random "Visit a randomly selected article [x]")
- [About Wikipedia](/wiki/Wikipedia:About "Learn about Wikipedia and how it works")
- [Contact us](//en.wikipedia.org/wiki/Wikipedia:Contact_us "How to contact Wikipedia")
- [Donate](https://donate.wikimedia.org/wiki/Special:FundraiserRedirector?utm_source=donate&utm_medium=sidebar&utm_campaign=C13_en.wikipedia.org&uselang=en "Support us by donating to the Wikimedia Foundation")

Contribute


- [Help](/wiki/Help:Contents "Guidance on how to use and edit Wikipedia")
- [Learn to edit](/wiki/Help:Introduction "Learn how to edit Wikipedia")
- [Community portal](/wiki/Wikipedia:Community_portal "The hub for editors")
- [Recent changes](/wiki/Special:RecentChanges "A list of recent changes to Wikipedia [r]")
- [Upload file](/wiki/Wikipedia:File_upload_wizard "Add images or other media for use on Wikipedia")

[![](/static/images/icons/wikipedia.png)![Wikipedia](/static/images/mobile/copyright/wikipedia-wordmark-en.svg)![The Free Encyclopedia](/static/images/mobile/copyright/wikipedia-tagline-en.svg)](/wiki/Main_Page)

[Search](/wiki/Special:Search "Search Wikipedia [f]")

Search

Appearance

- [Create account](/w/index.php?title=Special:CreateAccount&returnto=WebAuthn "You are encouraged to create an account and log in; however, it is not mandatory")
- [Log in](/w/index.php?title=Special:UserLogin&returnto=WebAuthn "You're encouraged to log in; however, it's not mandatory. [o]")

Personal tools

- [Create account](/w/index.php?title=Special:CreateAccount&returnto=WebAuthn "You are encouraged to create an account and log in; however, it is not mandatory")
- [Log in](/w/index.php?title=Special:UserLogin&returnto=WebAuthn "You're encouraged to log in; however, it's not mandatory. [o]")

Pages for logged out editors [learn more](/wiki/Help:Introduction)

- [Contributions](/wiki/Special:MyContributions "A list of edits made from this IP address [y]")
- [Talk](/wiki/Special:MyTalk "Discussion about edits from this IP address [n]")

## Contents

move to sidebarhide

- (Top)

- [1Background](#Background)
- [2Advantages over traditional password-based authentication](#Advantages_over_traditional_password-based_authentication)
- [3Overview](#Overview)Toggle Overview subsection  - [3.1Authentication](#Authentication)
  - [3.2Registration](#Registration)
- [4Support](#Support)
- [5API](#API)
- [6Reception](#Reception)
- [7See also](#See_also)
- [8References](#References)
- [9External links](#External_links)

Toggle the table of contents

# WebAuthn

10 languages

- [العربية](https://ar.wikipedia.org/wiki/%D9%88%D9%8A%D8%A8_%D8%A3%D9%88%D8%AB%D9%86 "ويب أوثن – Arabic")
- [Deutsch](https://de.wikipedia.org/wiki/WebAuthn "WebAuthn – German")
- [Español](https://es.wikipedia.org/wiki/WebAuthn "WebAuthn – Spanish")
- [Français](https://fr.wikipedia.org/wiki/WebAuthn "WebAuthn – French")
- [한국어](https://ko.wikipedia.org/wiki/WebAuthn "WebAuthn – Korean")
- [日本語](https://ja.wikipedia.org/wiki/WebAuthn "WebAuthn – Japanese")
- [ไทย](https://th.wikipedia.org/wiki/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AD%E0%B8%AD%E0%B9%80%E0%B8%97%E0%B8%99%E0%B8%97%E0%B8%B4%E0%B9%80%E0%B8%84%E0%B8%8A%E0%B8%B1%E0%B8%99 "เว็บออเทนทิเคชัน – Thai")
- [Türkçe](https://tr.wikipedia.org/wiki/WebAuthn "WebAuthn – Turkish")
- [Українська](https://uk.wikipedia.org/wiki/WebAuthn "WebAuthn – Ukrainian")
- [中文](https://zh.wikipedia.org/wiki/WebAuthn "WebAuthn – Chinese")

[Edit links](https://www.wikidata.org/wiki/Special:EntityPage/Q55637499#sitelinks-wikipedia "Edit interlanguage links")

- [Article](/wiki/WebAuthn "View the content page [c]")
- [Talk](/wiki/Talk:WebAuthn "Discuss improvements to the content page [t]")

English

- [Read](/wiki/WebAuthn)
- [Edit](/w/index.php?title=WebAuthn&action=edit "Edit this page [e]")
- [View history](/w/index.php?title=WebAuthn&action=history "Past revisions of this page [h]")

Tools

Tools

move to sidebarhide

Actions


- [Read](/wiki/WebAuthn)
- [Edit](/w/index.php?title=WebAuthn&action=edit "Edit this page [e]")
- [View history](/w/index.php?title=WebAuthn&action=history)

General


- [What links here](/wiki/Special:WhatLinksHere/WebAuthn "List of all English Wikipedia pages containing links to this page [j]")
- [Related changes](/wiki/Special:RecentChangesLinked/WebAuthn "Recent changes in pages linked from this page [k]")
- [Upload file](/wiki/Wikipedia:File_Upload_Wizard "Upload files [u]")
- [Special pages](/wiki/Special:SpecialPages "A list of all special pages [q]")
- [Permanent link](/w/index.php?title=WebAuthn&oldid=1231164321 "Permanent link to this revision of this page")
- [Page information](/w/index.php?title=WebAuthn&action=info "More information about this page")
- [Cite this page](/w/index.php?title=Special:CiteThisPage&page=WebAuthn&id=1231164321&wpFormIdentifier=titleform "Information on how to cite this page")
- [Get shortened URL](/w/index.php?title=Special:UrlShortener&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FWebAuthn)
- [Download QR code](/w/index.php?title=Special:QrCode&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FWebAuthn)
- [Wikidata item](https://www.wikidata.org/wiki/Special:EntityPage/Q55637499 "Structured data on this page hosted by Wikidata [g]")

Print/export


- [Download as PDF](/w/index.php?title=Special:DownloadAsPdf&page=WebAuthn&action=show-download-screen "Download this page as a PDF file")
- [Printable version](/w/index.php?title=WebAuthn&printable=yes "Printable version of this page [p]")

In other projects


Appearance

move to sidebarhide

From Wikipedia, the free encyclopedia

![](//upload.wikimedia.org/wikipedia/en/thumb/f/f2/Edit-clear.svg/40px-Edit-clear.svg.png)

This article **may be too technical for most readers to understand**. Please [help improve it](https://en.wikipedia.org/w/index.php?title=WebAuthn&action=edit) to [make it understandable to non-experts](/wiki/Wikipedia:Make_technical_articles_understandable "Wikipedia:Make technical articles understandable"), without removing the technical details._(February 2024)__([Learn how and when to remove this message](/wiki/Help:Maintenance_template_removal "Help:Maintenance template removal"))_

Public-key authentication standard

Web AuthenticationAbbreviationWebAuthnFirst published31 May 2016 (2016-05-31)Latest versionLevel 2 Recommendation

21 April 2021 (2021-04-21)Preview versionLevel 3 (FPWD)

15 December 2021 (2021-12-15)Organization[FIDO2 Project](/wiki/FIDO2_Project "FIDO2 Project") ( [FIDO Alliance](/wiki/FIDO_Alliance "FIDO Alliance") and [W3C](/wiki/World_Wide_Web_Consortium "World Wide Web Consortium"))Committee[Web Authentication Working Group](/wiki/Web_Authentication_Working_Group "Web Authentication Working Group")Editors

Current editors

- Jeff Hodges (Google)

- J.C. Jones (Mozilla)

- Michael B. Jones (Microsoft)

- Akshay Kumar (Microsoft)

- Emil Lundberg (Yubico)


Previous editors

- Dirk Balfanz (Google)

- Vijay Bharadwaj (Microsoft)

- Arnar Birgisson (Google)

- Alexei Czeskis (Google)

- Hubert Le Van Gong (PayPal)

- Angelo Liao (Microsoft)

- Rolf Lindemann (Nok Nok Labs)


Base standards

- [File API](/wiki/HTML5_File_API "HTML5 File API")
- WHATWG Encoding Standard
- Unicode AUX #29: Text Segmentation

Domain[Authentication](/wiki/Authentication "Authentication")

**Web Authentication** ( **WebAuthn**) is a [web standard](/wiki/Web_standard "Web standard") published by the [World Wide Web Consortium](/wiki/World_Wide_Web_Consortium "World Wide Web Consortium") (W3C).[\[1\]](#cite_note-W3C-WebAuthn-Level-1-1)[\[2\]](#cite_note-2)[\[3\]](#cite_note-3) WebAuthn is a core component of the [FIDO2 Project](/wiki/FIDO_Alliance#FIDO2 "FIDO Alliance") under the guidance of the [FIDO Alliance](/wiki/FIDO_Alliance "FIDO Alliance").[\[4\]](#cite_note-fido2-4) The goal of the project is to standardize an interface for authenticating users to web-based applications and services using [public-key cryptography](/wiki/Public-key_cryptography "Public-key cryptography"). WebAuthn credentials (which are themselves FIDO credentials) are sometimes referred to as **passkeys**.[\[5\]](#cite_note-5)

On the client side, support for WebAuthn can be implemented in a variety of ways. The underlying cryptographic operations are performed by an [authenticator](/wiki/Authenticator "Authenticator"), which is an abstract functional model that is mostly agnostic with respect to how the key material is managed. This makes it possible to implement support for WebAuthn purely in software, making use of a processor's [trusted execution environment](/wiki/Trusted_execution_environment "Trusted execution environment") or a [Trusted Platform Module](/wiki/Trusted_Platform_Module "Trusted Platform Module") (TPM). Sensitive cryptographic operations can also be offloaded to a roaming hardware authenticator that can in turn be accessed via [USB](/wiki/USB "USB"), [Bluetooth Low Energy](/wiki/Bluetooth_Low_Energy "Bluetooth Low Energy"), or [near-field communications](/wiki/Near-field_communication "Near-field communication") (NFC). A roaming hardware authenticator conforms to the FIDO [Client to Authenticator Protocol](/wiki/Client_to_Authenticator_Protocol "Client to Authenticator Protocol") (CTAP),[\[6\]](#cite_note-FIDO-CTAP-6) making WebAuthn effectively backward compatible with the FIDO [Universal 2nd Factor](/wiki/Universal_2nd_Factor "Universal 2nd Factor") (U2F) standard.[\[7\]](#cite_note-7)

Like legacy U2F, Web Authentication is resilient to verifier impersonation; that is, it is resistant to phishing attacks,[\[8\]](#cite_note-8) but unlike U2F, WebAuthn does not require a traditional password.\[ _[citation needed](/wiki/Wikipedia:Citation_needed "Wikipedia:Citation needed")_\] Moreover, a roaming hardware authenticator is resistant to malware since the private key material is at no time accessible to software running on the host machine.

The WebAuthn Level 1 and 2 standards were published as [W3C Recommendations](/wiki/W3C_recommendation "W3C recommendation") on 4 March 2019 and 8 April 2021 respectively.[\[1\]](#cite_note-W3C-WebAuthn-Level-1-1)[\[9\]](#cite_note-W3C-WebAuthn-announce-9)[\[10\]](#cite_note-W3C-WebAuthn-Level-2-10) A Level 3 specification is currently a _First Public Working Draft_ (FPWD).[\[11\]](#cite_note-W3C-WebAuthn-Level-3-11)

## Background

\[ [edit](/w/index.php?title=WebAuthn&action=edit&section=1 "Edit section: Background")\]

FIDO2 is the successor to FIDO Universal 2nd Factor (U2F). Whereas U2F only supports multi-factor mode, having been designed to strengthen existing username/password-based login flows, FIDO2 adds support for single-factor mode. In multi-factor mode, the authenticator is activated by a test of _user presence_, which usually consists of a simple button push; no password is required. In single-factor mode, the authenticator ( _something you have_) performs _user verification_.[\[12\]](#cite_note-12) Depending on the authenticator capabilities, this can be:[\[13\]](#cite_note-13)

- _something you know:_ a secret such as a [PIN](/wiki/Personal_identification_number "Personal identification number"), [passcode](/wiki/Password "Password") or swipe pattern
- _something you are:_ a [biometric](/wiki/Biometrics "Biometrics") such as fingerprint, iris or voice

Regardless of mode, the authenticator never shares its secrets or biometric data with the website.[\[14\]](#cite_note-14) Moreover, a single user's secret or biometric works with all websites, as the authenticator will select the correct [cryptographic key material](/wiki/Public-key_cryptography "Public-key cryptography") to use for the service requesting authentication after user verification was completed successfully.

A secret and biometric on the authenticator can be used together, similarly to how they would be used on a [smartphone](/wiki/Smartphone "Smartphone"). For example, a fingerprint is used to provide convenient access to your smartphone but occasionally fingerprint access fails, in which case a PIN can be used.

## Advantages over traditional password-based authentication

\[ [edit](/w/index.php?title=WebAuthn&action=edit&section=2 "Edit section: Advantages over traditional password-based authentication")\]

WebAuthn addresses by design many inherent issues in traditional password-based authentication:

- **Secure Credential Generation and Storage**: WebAuthn generates unique credentials for each website using robust algorithms, storing them securely in trusted authenticators. This eliminates common vulnerabilities such as:

  - Weak passwords that can be easily brute-forced due to insufficient length.
  - Predictable passwords vulnerable to dictionary attacks (e.g., "password", "12345678").
  - Guessable passwords based on personal information (e.g., birthdates, addresses).
  - Poor client-side password storage (e.g., written down, stored in phone contacts).
  - Password reuse across multiple websites, as WebAuthn credentials are specific to individual websites by design.
  - Inadequate server-mandated password requirements (e.g., overly lax or restrictive criteria, arbitrary maximum length limits, limited charsets).
  - Restrictions preventing password manager auto-fill features.
- **No Server-Side Credential Storage**: The private part of a credential is never stored on a server, eliminating risks and vulnerabilities such as:

  - Insecure password storage in databases (e.g., plaintext or relying on weak hash-based algorithms/constructions).
  - Database leaks exposing passwords.
  - Mandatory, ineffective periodic password changes.
- **Unique Credentials for Each Website**: WebAuthn ensures credentials are unique per website, eliminating the following risks and vulnerabilities:

  - Credential stuffing attacks, where attackers use credentials from one data breach across multiple sites.
  - Phishing attacks, as credentials cannot be reused or misapplied to different websites.

## Overview

\[ [edit](/w/index.php?title=WebAuthn&action=edit&section=3 "Edit section: Overview")\]

Like its predecessor FIDO U2F, W3C Web Authentication (WebAuthn) involves a [website](/wiki/Website "Website"), a [web browser](/wiki/Web_browser "Web browser"), and an authenticator:[\[1\]](#cite_note-W3C-WebAuthn-Level-1-1)

- The website is a conforming WebAuthn Relying Party
- The browser is a conforming WebAuthn Client
- The authenticator is a FIDO2 authenticator, that is, it is assumed to be compatible with the WebAuthn Client

WebAuthn specifies how a claimant demonstrates possession and control of a FIDO2 authenticator to a verifier called the WebAuthn Relying Party. The authentication process is mediated by an entity called the WebAuthn Client, which is little more than a conforming web browser.

### Authentication

\[ [edit](/w/index.php?title=WebAuthn&action=edit&section=4 "Edit section: Authentication")\]

[![](//upload.wikimedia.org/wikipedia/commons/thumb/0/04/Passwordless_Web_Authentication.svg/220px-Passwordless_Web_Authentication.svg.png)](/wiki/File:Passwordless_Web_Authentication.svg) A typical Web Authentication (WebAuthn) flow

For the purposes of illustration, we assume the authenticator is a roaming hardware authenticator (see below for other options). In any case, the authenticator is a multi-factor [cryptographic](/wiki/Cryptography "Cryptography") authenticator that uses [public-key cryptography](/wiki/Cryptography#Public-key_cryptography "Cryptography") to sign an authentication assertion targeted at the WebAuthn Relying Party. Assuming the authenticator uses a [PIN](/wiki/Personal_identification_number "Personal identification number") for user verification, the authenticator itself is _something you have_ while the PIN is _something you know_.

To initiate the WebAuthn authentication flow,[\[15\]](#cite_note-15) the WebAuthn Relying Party indicates its intentions to the WebAuthn Client (i.e., the browser) via [JavaScript](/wiki/JavaScript "JavaScript"). The WebAuthn Client communicates with the authenticator using a JavaScript [API](/wiki/API "API") implemented in the browser. A roaming authenticator conforms to the FIDO [Client to Authenticator Protocol](/wiki/Client_to_Authenticator_Protocol "Client to Authenticator Protocol").

WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (e.g., implemented on a smartphone) or a platform authenticator (i.e., an authenticator implemented directly on the WebAuthn Client Device) may be used. Relevant examples of platform authenticators include [Windows Hello](/wiki/Windows_Hello "Windows Hello")[\[16\]](#cite_note-16) and the [Android operating system](/wiki/Android_(operating_system) "Android (operating system)").[\[17\]](#cite_note-17)

The illustrated flow relies on PIN-based user verification, which, in terms of usability, is only a modest improvement over ordinary password authentication. In practice, the use of [biometrics](/wiki/Biometric "Biometric") for user verification can improve the usability of WebAuthn.\[ _[citation needed](/wiki/Wikipedia:Citation_needed "Wikipedia:Citation needed")_\] The logistics behind biometrics are still poorly understood, however. There is a lingering misunderstanding among users that biometric data is transmitted over the network in the same manner as passwords, which is not the case.[\[18\]](#cite_note-18)[\[19\]](#cite_note-19)

### Registration

\[ [edit](/w/index.php?title=WebAuthn&action=edit&section=5 "Edit section: Registration")\]

When the WebAuthn Relying Party receives the signed authentication assertion from the browser, the digital signature on the assertion is verified using a trusted public key for the user. How does the WebAuthn Relying Party obtain that trusted public key in the first place?

To obtain a public key for the user, the WebAuthn Relying Party initiates a WebAuthn registration flow[\[20\]](#cite_note-20) that is very similar to the authentication flow illustrated above. The primary difference is that the authenticator now signs an attestation statement with its attestation private key. The signed attestation statement contains a copy of the public key that the WebAuthn Relying Party ultimately uses to verify a signed authentication assertion. The attestation statement also contains metadata describing the authenticator itself.\[ _[citation needed](/wiki/Wikipedia:Citation_needed "Wikipedia:Citation needed")_\]

The digital signature on the attestation statement is verified with the trusted attestation public key for that particular model of authenticator. How the WebAuthn Relying Party obtains its store of trusted attestation public keys is unspecified. One option is to use the FIDO metadata service.[\[21\]](#cite_note-21)

The attestation type specified in the JavaScript determines the trust model. For instance, an attestation type called self-attestation may be desired, for which the trust model is essentially [trust on first use](/wiki/Trust_on_first_use "Trust on first use").

## Support

\[ [edit](/w/index.php?title=WebAuthn&action=edit&section=6 "Edit section: Support")\]

The WebAuthn Level 1 standard was published as a W3C Recommendation by the [Web Authentication Working Group](/wiki/Web_Authentication_Working_Group "Web Authentication Working Group") on 4 March 2019.[\[1\]](#cite_note-W3C-WebAuthn-Level-1-1)[\[9\]](#cite_note-W3C-WebAuthn-announce-9)[\[22\]](#cite_note-22) WebAuthn is supported by [Google Chrome](/wiki/Google_Chrome "Google Chrome"), [Mozilla Firefox](/wiki/Mozilla_Firefox "Mozilla Firefox"), [Microsoft Edge](/wiki/Microsoft_Edge "Microsoft Edge"), [Apple Safari](/wiki/Safari_(web_browser) "Safari (web browser)")[\[9\]](#cite_note-W3C-WebAuthn-announce-9) and [Opera](/wiki/Opera_(web_browser) "Opera (web browser)").[\[23\]](#cite_note-23)

The desktop version of Google Chrome has supported WebAuthn since version 67.[\[24\]](#cite_note-chrome-support-24) Firefox, which had not fully supported the previous FIDO U2F standard, included and enabled WebAuthn in Firefox version 60, released on 9 May 2018.[\[25\]](#cite_note-25) An early [Windows Insider](/wiki/Windows_Insider "Windows Insider") release of Microsoft Edge (Build 17682) implemented a version of WebAuthn that works with both [Windows Hello](/wiki/Windows_Hello "Windows Hello") as well as external security keys.[\[26\]](#cite_note-26)

Existing FIDO U2F security keys are largely compatible with the WebAuthn standard, though WebAuthn added the ability to reference a unique per-account "user handle" identifier, which older authenticators are unable to store.[\[1\]](#cite_note-W3C-WebAuthn-Level-1-1)

One of the first FIDO2-compatible [authenticators](/wiki/Authenticator "Authenticator") was the second-generation [Security Key](/wiki/YubiKey "YubiKey") by Yubico, announced on 10 April 2018.[\[27\]](#cite_note-27) The first FIDO2-compatible authenticators with a display was Trezor Model T by SatoshiLabs, announced on 6 November 2019.[\[28\]](#cite_note-28) Trezor Model T was also the first authenticator that allowed users to select which FIDO2 resident credential should be used directly on a device.

The first Security Level 2 certified FIDO2 key, called "Goldengate" was announced one year later by eWBM on 8 April 2019.[\[29\]](#cite_note-29)[\[30\]](#cite_note-30)

[Dropbox](/wiki/Dropbox "Dropbox") announced support for WebAuthn logins (as a 2nd factor) on 8 May 2018.[\[31\]](#cite_note-31)

[Apple](/wiki/Apple_Inc. "Apple Inc.") announced that [Face ID](/wiki/Face_ID "Face ID") or [Touch ID](/wiki/Touch_ID "Touch ID") could be used as a WebAuthn platform authenticator with [Safari](/wiki/Safari_(web_browser) "Safari (web browser)") on 24 June 2020.[\[32\]](#cite_note-32)

## API

\[ [edit](/w/index.php?title=WebAuthn&action=edit&section=7 "Edit section: API")\]

WebAuthn implements an extension of the W3C's more general [Credential Management](/wiki/Credential_Management "Credential Management") [API](/wiki/Application_programming_interface "Application programming interface"), which is an attempt to formalize the interaction between [websites](/wiki/Website "Website") and [web browsers](/wiki/Web_browser "Web browser") when exchanging user credentials. The Web Authentication API[\[33\]](#cite_note-33)[\[34\]](#cite_note-34) extends the Credential Management `navigator.credentials.create()` and `navigator.credentials.get()` [JavaScript](/wiki/JavaScript "JavaScript") methods so they accept a `publicKey` parameter. The `create()` method is used for registering public key [authenticators](/wiki/Authenticator "Authenticator") as part of associating them with user accounts (possibly at initial account creation time but more likely when adding a new security device to an existing account) while the `get()` method is used for authenticating (such as when logging in).

To check if a browser supports WebAuthn, scripts should check if the `window.PublicKeyCredential` interface is defined. In addition to `PublicKeyCredential`, the standard also defines the `AuthenticatorResponse`, `AuthenticatorAttestationResponse`, and `AuthenticatorAssertionResponse` interfaces in addition to a variety of dictionaries and other datatypes.

The API does not allow direct access to or manipulation of private keys, beyond requesting their initial creation.

## Reception

\[ [edit](/w/index.php?title=WebAuthn&action=edit&section=8 "Edit section: Reception")\]

In August 2018, Paragon Initiative Enterprises conducted a security audit of the WebAuthn standard. While they could not find any specific [exploits](/wiki/Exploit_(computer_security) "Exploit (computer security)"), they revealed some serious weaknesses in the way the underlying cryptography is used and mandated by the standard.[\[35\]](#cite_note-paragon-blog-35)

The main points of criticism revolve around two potential issues that were problematic in other cryptographic systems in the past and therefore should be avoided in order to not fall victim to the same class of attacks:

- Through the mandated use of [COSE](/w/index.php?title=CBOR_Object_Signing_and_Encryption&action=edit&redlink=1 "CBOR Object Signing and Encryption (page does not exist)") ( [RFC 8152](https://www.rfc-editor.org/rfc/rfc8152)) WebAuthn also supports [RSA](/wiki/RSA_(cryptosystem) "RSA (cryptosystem)") with [PKCS1v1.5 padding](/wiki/PKCS_1 "PKCS 1"). This particular scheme of padding is known to be vulnerable to [specific attacks](/wiki/Adaptive_chosen-ciphertext_attack "Adaptive chosen-ciphertext attack") for at least twenty years and it has been successfully attacked in other protocols and implementations of the RSA cryptosystem in the past. It is difficult to exploit under the given conditions in the context of WebAuthn, but given that there are more secure cryptographic primitives and padding schemes, this is still a bad choice and is not considered to be best practice among cryptographers any more.
- The FIDO Alliance standardized on the [asymmetric cryptographic](/wiki/Public-key_cryptography "Public-key cryptography") scheme [ECDAA](/w/index.php?title=ECDAA&action=edit&redlink=1 "ECDAA (page does not exist)").[\[36\]](#cite_note-ecdaa-spec-36) This is a version of [direct anonymous attestation](/wiki/Direct_Anonymous_Attestation "Direct Anonymous Attestation") based on [elliptic curves](/wiki/Elliptic_curve "Elliptic curve") and in the case of WebAuthn is meant to be used to verify the integrity of authenticators, while also preserving the privacy of users, as it does not allow for global correlation of handles. However, ECDAA does not incorporate some of the lessons that were learned in the last decades of research in the area of [elliptic curve cryptography](/wiki/Elliptic-curve_cryptography "Elliptic-curve cryptography"), as the chosen curve has some security deficits inherent to this type of curve, which reduces the security guarantees quite substantially. Furthermore, the ECDAA standard involves random, non-deterministic signatures, which already has been a problem in the past.

Paragon Initiative Enterprises also criticized how the standard was initially developed, as the proposal was not made public in advance and experienced cryptographers were not asked for suggestions and feedback. Hence the standard was not subject to broad cryptographic research from the academic world.

Despite these shortcomings, Paragon Initiative Enterprises still encourage users to continue to use WebAuthn but have come up with some recommendations for potential implementers and developers of the standard that they hope can be implemented before the standard is finalized. Avoiding such mistakes as early as possible would protect the industry from any challenges that are introduced by broken standards and the need for [backwards compatibility](/wiki/Backward_compatibility "Backward compatibility").

ECDAA was only designed to be used in combination with device attestation. This particular feature of WebAuthn is not necessarily required for authentication to work. Current implementations allow the user to decide whether an attestation statement is sent during the registration ceremony. Independently, relying parties can choose to require attestation or not. ECDAA was removed from WebAuthn Level 2 as it was not implemented by browsers nor relying parties.[\[37\]](#cite_note-37)

## See also

\[ [edit](/w/index.php?title=WebAuthn&action=edit&section=9 "Edit section: See also")\]

- [FIDO Alliance](/wiki/FIDO_Alliance "FIDO Alliance")

## References

\[ [edit](/w/index.php?title=WebAuthn&action=edit&section=10 "Edit section: References")\]

01. ^ [_**a**_](#cite_ref-W3C-WebAuthn-Level-1_1-0) [_**b**_](#cite_ref-W3C-WebAuthn-Level-1_1-1) [_**c**_](#cite_ref-W3C-WebAuthn-Level-1_1-2) [_**d**_](#cite_ref-W3C-WebAuthn-Level-1_1-3) [_**e**_](#cite_ref-W3C-WebAuthn-Level-1_1-4)Balfanz, Dirk; Czeskis, Alexei; Hodges, Jeff; Jones, J.C.; Jones, Michael B.; Kumar, Akshay; Liao, Angelo; Lindemann, Rolf; Lundberg, Emil (eds.). ["Web Authentication: An API for accessing Public Key Credentials Level 1 (latest)"](https://www.w3.org/TR/webauthn-1/). [World Wide Web Consortium](/wiki/World_Wide_Web_Consortium "World Wide Web Consortium"). Retrieved 4 March 2019.
02. **[^](#cite_ref-2)**["Web Authentication Working Group"](https://www.w3.org/blog/webauthn/). [World Wide Web Consortium](/wiki/World_Wide_Web_Consortium "World Wide Web Consortium"). Retrieved 11 May 2018.
03. **[^](#cite_ref-3)**Strickland, Jonathan (18 March 2019). ["What is WebAuthn"](https://www.iheart.com/podcast/105-techstuff-26941194/episode/what-is-webauthn-30705004/). [_TechStuff_](/wiki/HowStuffWorks#TechStuff "HowStuffWorks"). [iHeartMedia](/wiki/IHeartMedia "IHeartMedia"). 20:35 minutes in. Retrieved 20 March 2019.
04. **[^](#cite_ref-fido2_4-0)**["FIDO2 Project"](https://fidoalliance.org/fido2/). FIDO Alliance. Retrieved 11 May 2018.
05. **[^](#cite_ref-5)**["White Paper: Multi-Device FIDO Credentials"](https://fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf)(PDF). [FIDO Alliance](/wiki/FIDO_Alliance "FIDO Alliance"). March 2022. p. 6. Retrieved 20 May 2024.
06. **[^](#cite_ref-FIDO-CTAP_6-0)**Brand, Christiaan; Czeskis, Alexei; Ehrensvärd, Jakob; Jones, Michael B.; Kumar, Akshay; Lindemann, Rolf; Powers, Adam; Verrept, Johan, eds. (30 January 2019). ["Client to Authenticator Protocol (CTAP)"](https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html). FIDO Alliance. Retrieved 7 March 2019.
07. **[^](#cite_ref-7)**["WebAuthn / CTAP: Modern Authentication"](https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf)(PDF). [World Wide Web Consortium](/wiki/World_Wide_Web_Consortium "World Wide Web Consortium"). 10 December 2018. Retrieved 11 March 2019.
08. **[^](#cite_ref-8)**Kan, Michael (7 March 2019). ["Google: Phishing Attacks That Can Beat Two-Factor Are on the Rise"](https://www.pcmag.com/news/367026/google-phishing-attacks-that-can-beat-two-factor-are-on-the). PC Magazine. Retrieved 8 March 2019.
09. ^ [_**a**_](#cite_ref-W3C-WebAuthn-announce_9-0) [_**b**_](#cite_ref-W3C-WebAuthn-announce_9-1) [_**c**_](#cite_ref-W3C-WebAuthn-announce_9-2)["W3C and FIDO Alliance Finalize Web Standard for Secure, Passwordless Logins"](https://www.w3.org/2019/03/pressrelease-webauthn-rec.html.en). [World Wide Web Consortium](/wiki/World_Wide_Web_Consortium "World Wide Web Consortium"). 4 March 2019. Retrieved 4 March 2019.
10. **[^](#cite_ref-W3C-WebAuthn-Level-2_10-0)**Balfanz, Dirk; Czeskis, Alexei; Hodges, Jeff; Jones, J.C.; Jones, Michael B.; Kumar, Akshay; Lindemann, Rolf; Lundberg, Emil, eds. (8 April 2021). ["Web Authentication: An API for accessing Public Key Credentials Level 2"](https://www.w3.org/TR/webauthn-2/) (Latest ed.). [World Wide Web Consortium](/wiki/World_Wide_Web_Consortium "World Wide Web Consortium"). Retrieved 27 November 2022.
11. **[^](#cite_ref-W3C-WebAuthn-Level-3_11-0)**Balfanz, Dirk; Czeskis, Alexei; Hodges, Jeff; Jones, J.C.; Jones, Michael B.; Kumar, Akshay; Lindemann, Rolf; Lundberg, Emil, eds. (4 April 2021). ["Web Authentication: An API for accessing Public Key Credentials Level 3"](https://www.w3.org/TR/webauthn-3/) (First Public Working Draft ed.). [World Wide Web Consortium](/wiki/World_Wide_Web_Consortium "World Wide Web Consortium"). Retrieved 24 December 2021.
12. **[^](#cite_ref-12)**["User Presence vs User Verification"](https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/User_Presence_vs_User_Verification.html). Retrieved 19 February 2024.
13. **[^](#cite_ref-13)**Baghdasaryan, Davit; Hill, Brad (2 July 2018). ["FIDO Registry of Predefined Values"](https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-registry-v2.0-rd-20180702.html#user-verification-methods). _fidoalliance.org_. FIDO Alliance. Retrieved 16 June 2019.
14. **[^](#cite_ref-14)**["Web Authentication: An API for accessing Public Key Credentials Level 1 § Terminology: User Verification"](https://www.w3.org/TR/webauthn/Overview.html#user-verification). _www.w3.org_. W3C. 4 March 2019. Retrieved 16 June 2019.
15. **[^](#cite_ref-15)**["Web Authentication API"](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API). [Mozilla](/wiki/Mozilla "Mozilla"). Section [Authentication](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Authentication). Retrieved 18 March 2019.
16. **[^](#cite_ref-16)**Simons, Alex (20 November 2018). ["Secure password-less sign-in for your Microsoft account using a security key or Windows Hello"](https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/). [Microsoft](/wiki/Microsoft "Microsoft"). Retrieved 6 March 2019.
17. **[^](#cite_ref-17)**["Android Now FIDO2 Certified, Accelerating Global Migration Beyond Passwords"](https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/). BARCELONA: [FIDO Alliance](/wiki/FIDO_Alliance "FIDO Alliance"). 25 February 2019. Retrieved 6 March 2019.
18. **[^](#cite_ref-18)**["Touch ID and Beyond: Duo's Plans for WebAuthn"](https://duo.com/blog/touchid-webauthn). Duo Security. 5 March 2019. Retrieved 8 March 2019.
19. **[^](#cite_ref-19)**Steele, Nick (27 February 2019). ["How WebAuthn aims to solve the password problem"](https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/). Help Net Security. Retrieved 8 March 2019.
20. **[^](#cite_ref-20)**["Web Authentication API"](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API). [Mozilla](/wiki/Mozilla "Mozilla"). Section [Registration](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Registration). Retrieved 18 March 2019.
21. **[^](#cite_ref-21)**["Metadata Service"](https://fidoalliance.org/metadata/). [FIDO Alliance](/wiki/FIDO_Alliance "FIDO Alliance"). Retrieved 18 March 2019.
22. **[^](#cite_ref-22)**Protalinski, Emil (4 March 2019). ["W3C Approves WebAuthn as the Web Standard for Password-Free Logins"](https://venturebeat.com/2019/03/04/w3c-approves-webauthn-as-the-web-standard-for-password-free-logins/).
23. **[^](#cite_ref-23)**["Can I use Web Authentication API?"](https://caniuse.com/#feat=webauthn). Retrieved 7 March 2019.
24. **[^](#cite_ref-chrome-support_24-0)**Brand, Christiaan (3 June 2018). ["Enabling Strong Authentication with WebAuthn"](https://developers.google.com/web/updates/2018/05/webauthn). _Google Developers_. Retrieved 25 June 2018.
25. **[^](#cite_ref-25)**Shankland, Stephen (9 May 2018). ["Firefox moves browsers into post-password future with WebAuthn tech"](https://www.cnet.com/news/firefox-moves-browsers-into-the-post-password-future-with-webauthn/). _CNET_. Retrieved 11 May 2018.
26. **[^](#cite_ref-26)**Sarkar; et al. (23 May 2018). ["Announcing Windows 10 Insider Preview Build 17682"](https://blogs.windows.com/windowsexperience/2018/05/31/announcing-windows-10-insider-preview-build-17682/#oHYCS0GkF95OMzKH.97). Microsoft. Retrieved 25 June 2018.
27. **[^](#cite_ref-27)**["Yubico Launches New Developer Program and Security Key for FIDO2 and WebAuthn W3C Specifications"](https://www.yubico.com/press-releases/280530/) (Press release). 10 April 2018. Retrieved 11 May 2018.
28. **[^](#cite_ref-28)**["Make Passwords a Thing of the Past, FIDO2 Is Now Available on Trezor Model T"](https://medium.com/trezor-security-blog/make-passwords-a-thing-of-the-past-a402745750dc). 6 November 2019. Retrieved 6 November 2019.
29. **[^](#cite_ref-29)**["eWBM: eWBM's Goldengate Fingerprint Reader is First to Get FIDO L2 Certification"](https://www.ewbm.com/press/pr2/) (Press release). 8 April 2019. Retrieved 15 June 2019.
30. **[^](#cite_ref-30)**["Mobile ID World, Alex Perala: eWBM's Goldengate Fingerprint Reader is First to Get FIDO L2 Certification"](https://mobileidworld.com/ewbm-goldengate-fingerprint-reader-fido-l2-certification-804084/) (Press release). 9 April 2019. Retrieved 15 June 2019.
31. **[^](#cite_ref-31)**Girardeau, Brad (8 May 2018). ["Introducing WebAuthn support for secure Dropbox sign in"](https://blogs.dropbox.com/tech/2018/05/introducing-webauthn-support-for-secure-dropbox-sign-in/). _Dropbox Tech Blog_. Dropbox. Retrieved 11 May 2018.
32. **[^](#cite_ref-32)**["Safari 14 Release Notes"](https://developer.apple.com/documentation/safari-release-notes/safari-14-release-notes). _Apple Developer Documentation_. 16 December 2022. Retrieved 16 December 2022.
33. **[^](#cite_ref-33)**["Web Authentication API"](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API). [Mozilla](/wiki/Mozilla "Mozilla"). Retrieved 16 March 2019.
34. **[^](#cite_ref-34)**Ackermann, Yuriy (15 January 2019). ["Introduction to WebAuthn API"](https://medium.com/@herrjemand/introduction-to-webauthn-api-5fd1fb46c285). Medium. Retrieved 8 March 2019.
35. **[^](#cite_ref-paragon-blog_35-0)**["Security Concerns Surrounding WebAuthn: Don't Implement ECDAA (Yet)"](https://paragonie.com/blog/2018/08/security-concerns-surrounding-webauthn-don-t-implement-ecdaa-yet). Paragon Initiative Enterprises Blog. 23 August 2018. Retrieved 9 October 2018.
36. **[^](#cite_ref-ecdaa-spec_36-0)**["FIDO ECDAA Algorithm"](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html). FIDO Alliance. 27 February 2018. Retrieved 9 October 2018.
37. **[^](#cite_ref-37)**["Remove ECDAA? · Issue #1410 · w3c/webauthn"](https://github.com/w3c/webauthn/issues/1410). _GitHub_. 28 April 2020. Retrieved 3 June 2020.

## External links

\[ [edit](/w/index.php?title=WebAuthn&action=edit&section=11 "Edit section: External links")\]

- [Web Authentication: An API for accessing Public Key Credentials](https://www.w3.org/TR/webauthn/)
- [Web Authentication Working Group](https://www.w3.org/Webauthn/)
- [Web Authentication API on MDN](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API)
- [WebAuthn Awesome](https://github.com/herrjemand/awesome-webauthn)

- [v](/wiki/Template:Web_interfaces "Template:Web interfaces")
- [t](/wiki/Template_talk:Web_interfaces "Template talk:Web interfaces")
- [e](/wiki/Special:EditPage/Template:Web_interfaces "Special:EditPage/Template:Web interfaces")

[Web interfaces](/wiki/Web_API "Web API")

[Server-side](/wiki/Server-side "Server-side")

[Protocols](/wiki/Communication_protocol "Communication protocol")

- [HTTP](/wiki/HTTP "HTTP")
  - [v2](/wiki/HTTP/2 "HTTP/2")
  - [v3](/wiki/HTTP/3 "HTTP/3")
  - [Encryption](/wiki/HTTPS "HTTPS")
  - [WebDAV](/wiki/WebDAV "WebDAV")
- [CGI](/wiki/Common_Gateway_Interface "Common Gateway Interface")
- [SCGI](/wiki/Simple_Common_Gateway_Interface "Simple Common Gateway Interface")
- [FCGI](/wiki/FastCGI "FastCGI")
- [AJP](/wiki/Apache_JServ_Protocol "Apache JServ Protocol")
- [WSRP](/wiki/Web_Services_for_Remote_Portlets "Web Services for Remote Portlets")
- [WebSocket](/wiki/WebSocket "WebSocket")

[Server APIs](/wiki/Server_application_programming_interface "Server application programming interface")

- [C NSAPI](/wiki/Netscape_Server_Application_Programming_Interface "Netscape Server Application Programming Interface")
- [C ASAPI](/wiki/Apache_HTTP_Server#Feature_overview "Apache HTTP Server")
- [C ISAPI](/wiki/Internet_Server_Application_Programming_Interface "Internet Server Application Programming Interface")
- [COM ASP](/wiki/Active_Server_Pages "Active Server Pages")
- [Jakarta Servlet](/wiki/Jakarta_Servlet "Jakarta Servlet")
  - [container](/wiki/Web_container "Web container")
- [CLI OWIN](/wiki/Open_Web_Interface_for_.NET "Open Web Interface for .NET")
- [ASP.NET Handler](/wiki/HTTP_handler "HTTP handler")
- [Python WSGI](/wiki/Web_Server_Gateway_Interface "Web Server Gateway Interface")
- [Python ASGI](/wiki/Asynchronous_Server_Gateway_Interface "Asynchronous Server Gateway Interface")
- [Ruby Rack](/wiki/Rack_(web_server_interface) "Rack (web server interface)")
- [JavaScript JSGI](/wiki/JSGI "JSGI")
- [Perl PSGI](/wiki/Plack_(software)#PSGI "Plack (software)")
- [Portlet](/wiki/Java_Portlet_Specification "Java Portlet Specification")
  - [container](/wiki/Java_Portlet_Specification "Java Portlet Specification")

[Apache modules](/wiki/List_of_Apache_modules "List of Apache modules")

- [mod\_include](/wiki/Server_Side_Includes "Server Side Includes")
- [mod\_jk](/wiki/Mod_jk "Mod jk")
- [mod\_lisp](/wiki/Mod_lisp "Mod lisp")
- [mod\_mono](/wiki/Mod_mono "Mod mono")
- [mod\_parrot](/wiki/Mod_parrot "Mod parrot")
- [mod\_perl](/wiki/Mod_perl "Mod perl")
- [mod\_php](/wiki/PHP "PHP")
- [mod\_proxy](/wiki/Mod_proxy "Mod proxy")
- [mod\_python](/wiki/Mod_python "Mod python")
- [mod\_wsgi](/wiki/Mod_wsgi "Mod wsgi")
- [mod\_ruby](/wiki/Mod_ruby "Mod ruby")
- [Phusion Passenger](/wiki/Phusion_Passenger "Phusion Passenger")

Topics

- [Web service](/wiki/Web_service "Web service") vs. [Web resource](/wiki/Web_resource "Web resource")
- [WOA](/wiki/Web-oriented_architecture "Web-oriented architecture") vs. [ROA](/wiki/Resource-oriented_architecture "Resource-oriented architecture")
- [Open API](/wiki/Open_API "Open API")
- [Webhook](/wiki/Webhook "Webhook")
- [Application server](/wiki/Application_server "Application server")
  - [comparison](/wiki/List_of_application_servers "List of application servers")
- [Scripting](/wiki/Server-side_scripting "Server-side scripting")

[Client-side](/wiki/Client-side "Client-side")

[Browser APIs](/wiki/Plug-in_(computing) "Plug-in (computing)")

- [C NPAPI](/wiki/NPAPI "NPAPI")
  - [LiveConnect](/wiki/NPAPI#LiveConnect "NPAPI")
  - [XPConnect](/wiki/NPAPI#XPConnect "NPAPI")
- [C NPRuntime](/wiki/NPAPI#NPRuntime "NPAPI")
- [C PPAPI](/wiki/Google_Native_Client#Pepper "Google Native Client")
  - [NaCl](/wiki/Google_Native_Client "Google Native Client")
- [ActiveX](/wiki/ActiveX "ActiveX")
- [BHO](/wiki/Browser_Helper_Object "Browser Helper Object")
- [XBAP](/wiki/XAML_Browser_Applications "XAML Browser Applications")

[Web APIs](/wiki/Web_API#Client_side "Web API")

[WHATWG](/wiki/WHATWG "WHATWG")

- [Audio](/wiki/HTML_audio "HTML audio")
- [Canvas](/wiki/Canvas_element "Canvas element")
- [CORS](/wiki/Cross-origin_resource_sharing "Cross-origin resource sharing")
- [DOM](/wiki/Document_Object_Model "Document Object Model")
- [SSE](/wiki/Server-sent_events "Server-sent events")
- [Video](/wiki/HTML_video "HTML video")
- [WebSockets](/wiki/WebSocket "WebSocket")
- [Web messaging](/wiki/Web_Messaging "Web Messaging")
- [Web storage](/wiki/Web_storage "Web storage")
- [Web worker](/wiki/Web_worker "Web worker")
- [XMLHttpRequest](/wiki/XMLHttpRequest "XMLHttpRequest")

[W3C](/wiki/World_Wide_Web_Consortium "World Wide Web Consortium")

- [DOM events](/wiki/DOM_event "DOM event")
- [EME](/wiki/Encrypted_Media_Extensions "Encrypted Media Extensions")
- [File](/wiki/HTML5_File_API "HTML5 File API")
- [Geolocation](/wiki/W3C_Geolocation_API "W3C Geolocation API")
- [IndexedDB](/wiki/Indexed_Database_API "Indexed Database API")
- [MSE](/wiki/Media_Source_Extensions "Media Source Extensions")
- [SVG](/wiki/SVG "SVG")
- [WebAssembly](/wiki/WebAssembly "WebAssembly")
- WebAuthn
- [WebGPU](/wiki/WebGPU "WebGPU")
- [WebRTC](/wiki/WebRTC "WebRTC")
- [WebXR](/wiki/WebXR "WebXR")

[Khronos](/wiki/Khronos_Group "Khronos Group")

- [WebCL](/wiki/WebCL "WebCL")
- [WebGL](/wiki/WebGL "WebGL")

Others

- [Gears](/wiki/Gears_(software) "Gears (software)")
- [GraphQL](/wiki/GraphQL "GraphQL")
- [Web SQL Database](/wiki/Web_SQL_Database "Web SQL Database") (formerly W3C)
- [WebUSB](/wiki/WebUSB "WebUSB")

Topics

- [Ajax](/wiki/Ajax_(programming) "Ajax (programming)") and [Remote scripting](/wiki/Remote_scripting "Remote scripting") vs. [DHTML](/wiki/Dynamic_HTML "Dynamic HTML")
- [Browser extension](/wiki/Browser_extension "Browser extension")
- [Mashup](/wiki/Mashup_(web_application_hybrid) "Mashup (web application hybrid)")
- [Web IDL](/wiki/Web_IDL "Web IDL")
- [Scripting](/wiki/Dynamic_web_page#Client-side_scripting "Dynamic web page")

Topics

- [Microservices](/wiki/Microservices "Microservices")
- [Web page](/wiki/Web_page "Web page")
  - [Static](/wiki/Static_web_page "Static web page")
  - [Dynamic](/wiki/Dynamic_web_page "Dynamic web page")
- [Web standards](/wiki/Web_standards "Web standards")
  - [REST](/wiki/REST "REST")
- [Web API security](/wiki/Web_API_security "Web API security")
- [Web application](/wiki/Web_application "Web application")
  - [Rich](/wiki/Rich_Internet_Application "Rich Internet Application")
  - [Single-page](/wiki/Single-page_application "Single-page application")
  - [Progressive](/wiki/Progressive_web_app "Progressive web app")
- [Web framework](/wiki/Web_framework "Web framework")

Retrieved from " [https://en.wikipedia.org/w/index.php?title=WebAuthn&oldid=1231164321](https://en.wikipedia.org/w/index.php?title=WebAuthn&oldid=1231164321)"

[Categories](/wiki/Help:Category "Help:Category"):

- [Authentication methods](/wiki/Category:Authentication_methods "Category:Authentication methods")
- [Identification](/wiki/Category:Identification "Category:Identification")
- [World Wide Web Consortium standards](/wiki/Category:World_Wide_Web_Consortium_standards "Category:World Wide Web Consortium standards")
- [Internet security](/wiki/Category:Internet_security "Category:Internet security")
- [Web technology](/wiki/Category:Web_technology "Category:Web technology")

Hidden categories:

- [Wikipedia articles that are too technical from February 2024](/wiki/Category:Wikipedia_articles_that_are_too_technical_from_February_2024 "Category:Wikipedia articles that are too technical from February 2024")
- [All articles that are too technical](/wiki/Category:All_articles_that_are_too_technical "Category:All articles that are too technical")
- [Articles with short description](/wiki/Category:Articles_with_short_description "Category:Articles with short description")
- [Short description matches Wikidata](/wiki/Category:Short_description_matches_Wikidata "Category:Short description matches Wikidata")
- [Use dmy dates from October 2023](/wiki/Category:Use_dmy_dates_from_October_2023 "Category:Use dmy dates from October 2023")
- [All articles with unsourced statements](/wiki/Category:All_articles_with_unsourced_statements "Category:All articles with unsourced statements")
- [Articles with unsourced statements from September 2023](/wiki/Category:Articles_with_unsourced_statements_from_September_2023 "Category:Articles with unsourced statements from September 2023")
- [Articles with unsourced statements from March 2019](/wiki/Category:Articles_with_unsourced_statements_from_March_2019 "Category:Articles with unsourced statements from March 2019")

- This page was last edited on 26 June 2024, at 20:56 (UTC).
- Text is available under the [Creative Commons Attribution-ShareAlike License 4.0](//en.wikipedia.org/wiki/Wikipedia:Text_of_the_Creative_Commons_Attribution-ShareAlike_4.0_International_License);
additional terms may apply. By using this site, you agree to the [Terms of Use](//foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Terms_of_Use) and [Privacy Policy](//foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Privacy_policy). Wikipedia® is a registered trademark of the [Wikimedia Foundation, Inc.](//wikimediafoundation.org/), a non-profit organization.

- [Privacy policy](https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Privacy_policy)
- [About Wikipedia](/wiki/Wikipedia:About)
- [Disclaimers](/wiki/Wikipedia:General_disclaimer)
- [Contact Wikipedia](//en.wikipedia.org/wiki/Wikipedia:Contact_us)
- [Code of Conduct](https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Universal_Code_of_Conduct)
- [Developers](https://developer.wikimedia.org)
- [Statistics](https://stats.wikimedia.org/#/en.wikipedia.org)
- [Cookie statement](https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Cookie_statement)
- [Mobile view](//en.m.wikipedia.org/w/index.php?title=WebAuthn&mobileaction=toggle_view_mobile)

- [![Wikimedia Foundation](/static/images/footer/wikimedia-button.svg)](https://wikimediafoundation.org/)
- [![Powered by MediaWiki](/w/resources/assets/poweredby_mediawiki.svg)](https://www.mediawiki.org/)