What FIDO2 (and U2F) is
FIDO2 is the open standard that makes it possible to sign into a website with a security key, a passkey or your fingerprint, with no password traveling anywhere. You don't configure it yourself: you use it without noticing.
- What it is
- Passwordless standard
- Since
- 2014 (U2F), 2018-2019 (FIDO2)
- Verdict
- Yes
What it is
FIDO2 is the set of technical rules that lets a website verify who you are using cryptography instead of a password. It has two pieces: WebAuthn, the part your browser speaks, and CTAP2, the part your security key or phone speaks. When you use a passkey or connect a security key, FIDO2 is working underneath.
Its predecessor was U2F ("Universal 2nd Factor"): a more limited protocol, meant only as a second factor alongside a password, not to replace it. FIDO2 expands that idea so the credential can replace the password entirely, not just accompany it.
When it was introduced
U2F was created in 2014, when Google and Yubico launched the first joint support in Gmail, Chrome and Yubico's security key. In April 2018, the FIDO Alliance and the W3C announced the joint milestone that shaped FIDO2, moving WebAuthn to Candidate Recommendation stage. WebAuthn became an official W3C Recommendation on March 4, 2019.
Why it's used
Being an open standard, the same key or passkey works the same way on Gmail, GitHub or your bank, without each one having to invent its own system. And because it checks the website's actual domain before responding, it can't be fooled by a fake copy.
There's another, less visible advantage: since there's no password stored on the server, a data breach on one site can't be used to get into your other accounts with the same reused password. FIDO2 eliminates that problem at the root, rather than just mitigating it.
It isn't something you need to check directly yourself: the risk isn't in the standard, but in where each service stores the key or passkey that uses it (on a single device, or in a synced keychain). That depends on the specific case.
Should you use it?
Yes, with nothing to decide. You use it the moment you turn on a passkey or connect a security key; there's no "enable FIDO2" checkbox.
Check this
- Does the service you use offer "security key" or "passkey" among its sign-in options?
- Do you know whether that specific option is synced or tied to a single device?
Official sources: FIDO Alliance · W3C