WebAuthn

What is WebAuthn?

WebAuthn (Web Authentication) is a W3C standard that lets a website register and verify public key credentials directly through the browser, with no password involved. It became a W3C Recommendation in March 2019 and is the component of FIDO2 that runs on the web side, exposed to developers through the navigator.credentials API.

How WebAuthn works

• The website calls navigator.credentials.create() to register a new credential for the user.
• The browser passes the request to an authenticator: a platform one such as Touch ID or Windows Hello, or a roaming one such as a USB or NFC key.
• The authenticator creates a key pair scoped to the site origin and returns only the public key.
• At login, navigator.credentials.get() triggers a challenge that the authenticator signs locally.
• The browser enforces the origin check, which is what makes the credential unusable on a phishing domain.

WebAuthn and FIDO2: what is the difference?

WebAuthn is one half of FIDO2. It defines how the browser and the website exchange credentials. CTAP defines how the browser talks to an external authenticator such as a hardware key. A platform passkey on a laptop uses WebAuthn alone, while a USB security key uses WebAuthn plus CTAP.

Examples and use cases

An IT team enables WebAuthn on its identity provider so employees sign in with Windows Hello or Touch ID and then reach every federated application through single sign-on. The experience improves and the help desk handles fewer password resets. The limit is scope: only applications behind the identity provider inherit that protection. Anything with a standalone login keeps its own password policy and its own risk, which is why the first step is an inventory of what is actually connected. Corma builds and maintains that inventory continuously.

Related concepts

• Identity and access management platform
• IAM for IT teams
• Automate user access requests

FAQ

Is WebAuthn supported by all browsers?

Chrome, Edge, Safari, and Firefox all support it on current desktop and mobile versions. Support for specific authenticator types and for synced passkeys still varies by platform.

Does WebAuthn work without a hardware key?

Yes. Platform authenticators such as Touch ID, Face ID, and Windows Hello use the sensor already built into the device, so no separate key is required.

Is biometric data sent to the website with WebAuthn?

No. The biometric check happens locally on the device and only unlocks the private key. The site receives a signature and a public key, never the biometric template.

Can WebAuthn replace passwords completely?

For applications that support it, yes. In practice most companies run it alongside passwords until every tool in the estate can be brought behind single sign-on.

Request a demo