The encyclopedia · Software & IT · Product decision · 2019–2021
WebAuthn made passwords optional by putting public keys in every device
The FIDO Alliance and W3C turned device hardware into authenticators, and Apple, Google and Microsoft shipped it.
FIDO Alliance
the move
Passwords had one fatal weakness: users typed them into fake sites. The FIDO Alliance set out to replace shared secrets with public-key cryptography, and worked with the W3C to turn that into a web standard.
WebAuthn defines an API where the browser asks a device for a public-key credential: the device proves it holds the private key, and the key never leaves secure hardware. Because each credential is bound to the site's origin, phishing sites get nothing even if they trick the user.
The W3C published WebAuthn as a Recommendation in March 2019, and Apple, Google and Microsoft built it into browsers and operating systems — Touch ID, Windows Hello and Android biometrics all became authenticators. Users gained passwordless login without installing anything.
why it works
- Private keys never leave the device, so credentials cannot be phished
- Origin binding makes a fake site's login attempt worthless
- Built into every major OS, adoption needed no new app
- Passkeys gave the technology a consumer-friendly name and flow
what transfers
A standard wins when platform vendors ship it inside the operating system, so users adopt it by upgrading rather than by installing something.
what came after
WebAuthn became the basis of passkeys, supported by Apple, Google and Microsoft, with billions of devices capable of using it. It is now the standard answer to passwordless, phishing-resistant authentication on the web.
references
spotted an error? The archive wants to know.