IT Glossary
FIDO2 is the open standard behind passkeys and security keys. Learn how it blocks phishing, what WebAuthn and CTAP do, and where to deploy it first.
August 7, 2026
FIDO2 is an open authentication standard, developed by the FIDO Alliance and the W3C, that replaces passwords with a public key credential stored on a device or a hardware security key. It combines two specifications: WebAuthn, the browser API, and CTAP, the protocol between the browser and the authenticator. Its defining property is phishing resistance.
The binding to the origin is the whole point. With TOTP, a user can be tricked into typing a valid code into the wrong site. With FIDO2, the authenticator checks the domain itself and refuses to sign. Taking human judgment out of that step is what makes it structurally different from every code-based factor.
A 250-person SaaS company issues hardware security keys to its 14 administrators and enables passkeys for everyone else. Admin phishing attempts stop working immediately, because a fake console cannot obtain a signature. The remaining risk simply moves: applications outside single sign-on still authenticate with a password and a code. Mapping which tools actually sit behind the identity provider is the prerequisite to any FIDO2 rollout, and that map is what Corma produces from the real application estate.
A passkey is a FIDO2 credential that can be synced across a user's devices through their platform account. FIDO2 is the standard, and the passkey is the user-facing form it takes.
No. WebAuthn is the browser API inside FIDO2. FIDO2 also includes CTAP, the protocol that lets an external security key communicate with the browser.
No. FIDO2 supports fully passwordless login, where the security key or passkey plus a local gesture is the only credential presented.
On administrator, finance, and executive accounts, then on any application holding regulated data. These are the accounts phishing campaigns target first and the ones where a single compromise costs the most.
