What WebAuthn is
WebAuthn is the piece built into your browser that lets a website ask your security key or your passkey to confirm who you are, without going through a password.
- What it is
- Browser API
- Since
- 2019
- Verdict
- Yes
What it is
WebAuthn is the half of FIDO2 that lives in the browser. It's the common language a website uses to ask "prove it's you," and your security key, your fingerprint or your passkey answers, without a password traveling along the way. It's built into Chrome, Safari, Edge and Firefox: there's nothing to install.
Underneath, it distinguishes two kinds of "authenticator": one built into the device itself (your fingerprint, your face, your phone's PIN) and an external one you connect or tap (a security key). WebAuthn talks to both the same way, so a website doesn't care which one you use: it only cares that the response is valid.
Since when
The W3C (the organization that defines web standards) published WebAuthn as an official Recommendation on March 4, 2019, after advancing to Candidate Recommendation in April 2018 together with the FIDO Alliance. Since then, all major browsers support it natively.
Why it's used
Before WebAuthn, every security key manufacturer had to negotiate its own support with each browser. As a shared standard, any website can offer "log in with a key or a passkey" using the same code, and any compatible key or passkey works on any website that supports it.
Since it lives in the browser and not in a specific service, it's not something you can lose by switching phones: what you can lose is the key or the passkey WebAuthn uses underneath, which is where the real risk is.
Another practical advantage: many browsers offer you the passkey directly in the field where you'd normally type your username, before you even type anything. That makes logging in without a password faster than with one, not just more secure.
Do we use it?
Yes, without having to touch anything. If your browser is up to date, you're already using it every time you log in with a passkey or a security key.
Check this
- Are your browser and your operating system updated to a recent version?
- Do you recognize the "use a security key or this device" prompt when it appears at login?
Official sources: W3C · FIDO Alliance