WebAuthn and Passkeys: Passwordless Authentication Explained

WebAuthn is a web standard for strong, passwordless authentication using public-key cryptography, and passkeys are the user-friendly form of the credentials it creates. Part of the FIDO2 set of specifications, WebAuthn lets users prove their identity with a device they already have, such as a phone or laptop, instead of a password that can be phished, reused, or leaked in a breach. Its defining property is resistance to phishing, which addresses the root cause of a large share of account compromises.

Why Passwords Fall Short

Passwords are shared secrets: the user and the server both know them. That model creates many failure modes, including reuse across sites, database breaches that expose hashes, and phishing pages that trick users into revealing credentials. Even one-time codes can be relayed by a convincing fake site. WebAuthn removes the shared secret entirely, so there is nothing for an attacker to phish or steal from the server.

How WebAuthn Works

WebAuthn is built on public-key cryptography. During registration, the user's device, called an authenticator, generates a unique key pair for the site. The private key never leaves the device, while the public key is sent to the server, known as the relying party. Authentication is a challenge-response exchange proving the user controls the private key.

The Registration Ceremony

1. The relying party sends a random challenge and its identifier to the browser.
2. The authenticator creates a new key pair scoped to that site and protects the private key with hardware where available.
3. The user confirms with a local gesture, such as a fingerprint, face scan, or PIN.
4. The device returns the public key and a signed attestation, which the server stores against the user's account.

The Authentication Ceremony

1. The relying party sends a fresh random challenge.
2. The authenticator signs the challenge with the stored private key after the user's local verification.
3. The browser returns the signed assertion, and the server verifies it with the stored public key.

// Authentication, conceptually
const assertion = await navigator.credentials.get({
  publicKey: { challenge, rpId: "example.com", userVerification: "required" }
});
// The server verifies the signature over the challenge with the stored public key

Why WebAuthn Resists Phishing

The critical security feature is origin binding. The browser ties each credential to the exact origin that created it and includes that origin information in what the authenticator signs. If a user lands on a look-alike domain, the browser will not offer the credential registered for the real site, and any signature would not validate for the wrong origin. Because the private key never travels and each challenge is single-use, there is nothing for a fake site to capture and replay.

Passkeys and Authenticator Types

A passkey is a WebAuthn credential designed for everyday use, typically a discoverable credential that lets a user sign in without first typing a username. Authenticators come in two broad forms:

• Platform authenticators are built into a device, such as a laptop's secure enclave or a phone's biometric system.
• Roaming authenticators are external, such as a security key connected over USB, NFC, or Bluetooth.

Many passkeys are synced through a provider's secure cloud so they are available across a user's devices, improving recoverability, while others are bound to a single device for the highest assurance. The relying party can express requirements, such as demanding user verification, to match its risk tolerance.

Deploying WebAuthn Securely

1. Validate the ceremony fully. Verify the signature, confirm the challenge matches one you issued, and check that the origin and relying party identifier are correct.
2. Store public keys and metadata, including the credential identifier and signature counter, and use the counter to detect cloned authenticators where applicable.
3. Require user verification for sensitive contexts so presence alone is not sufficient.
4. Support multiple credentials per account and offer sensible recovery so users are not locked out if a device is lost.
5. Layer with identity flows such as OAuth 2.0 and OpenID Connect, where WebAuthn strengthens the authentication step.

WebAuthn Compared to Traditional MFA

Classic multi-factor authentication adds a second step, but many forms remain phishable because the user can be induced to hand over a code. WebAuthn is fundamentally different: the cryptographic proof is bound to the legitimate origin and cannot be relayed to an attacker's site. This makes it a phishing-resistant factor rather than merely an additional one, and it can serve as both a first factor and a strong second factor.

Key Takeaways

• WebAuthn provides passwordless authentication using public-key cryptography, with passkeys as its user-friendly credentials.
• The private key never leaves the authenticator, so there is no shared secret to phish or steal from the server.
• Origin binding makes WebAuthn phishing-resistant, because credentials only work on the site that created them.
• Registration produces a stored public key and attestation; authentication is a signed challenge-response assertion.
• Validate every ceremony carefully, require user verification where needed, and provide account recovery options.