Cybersecurity glossary
What is FIDO2?
Learn what FIDO2 is, how WebAuthn and CTAP enable passkeys and security keys, why FIDO2 resists phishing, and how organizations deploy FIDO2 for workforce and customer login.
Definition
FIDO2 is an open authentication standard suite—primarily W3C WebAuthn plus FIDO Client to Authenticator Protocol (CTAP)—that enables phishing-resistant, public-key authentication using platform passkeys or roaming authenticators instead of shared passwords.
Why FIDO2 changed authentication
Passwords and SMS codes are easy to phish because users can type them into the wrong place. FIDO2 replaces shared secrets with origin-bound public-key cryptography: the private key stays in an authenticator, and only the legitimate site receives a valid assertion.
That design underpins passkeys, security keys, and many passwordless programs.
The FIDO2 building blocks
WebAuthn
Web API that relying parties use to register credentials and request signed challenges.
CTAP
Protocol between the client platform and external authenticators such as USB/NFC/BLE keys.
Authenticators
Platform passkey providers or roaming hardware that hold private keys.
Relying party
The website or service that verifies signatures and stores public credentials.
Attestation (optional)
Evidence about authenticator make/model used in some enterprise policies.
User verification
PIN, biometric, or gesture proving a human is present at the authenticator.
Registration and authentication ceremonies
Register (create credential)
The relying party sends a challenge; the authenticator generates a key pair bound to the RP ID.
Store public key
The server saves the credential ID and public key; the private key never leaves the authenticator.
Authenticate
On login, the RP issues a new challenge for the registered credential.
Sign with presence/UV
The authenticator signs after user verification or presence check, scoped to the real origin.
Verify and open session
The RP validates the assertion and establishes an application session or federation proof.
FIDO2 compared with weaker MFA
| Method | Easily phishable? | Notes |
|---|---|---|
| SMS OTP | Yes | Codes can be entered on fake sites; SIM swap risk |
| App TOTP | Yes | Better than SMS, still relayable in real time |
| Push approve | Indirectly | Fatigue and accidental approvals |
| FIDO2 / passkeys | No (origin-bound) | Private key never typed; assertion bound to RP |
Deployment checklist
- Offer FIDO2 as primary MFA or passwordless for admins and high-risk users first.
- Support both platform passkeys and roaming security keys for coverage and recovery.
- Harden account recovery so fallbacks do not undo phishing resistance.
- Validate WebAuthn origin, RP ID, challenge freshness, and signature strictly.
- Decide whether enterprise attestation is required for controlled authenticator inventories.
- Educate users that legitimate sites will not ask them to type security-key secrets.
- Monitor registration of new authenticators as a sensitive account event.
- Plan for lost devices: backup keys, delegated recovery, or controlled admin reset.
The practical takeaway
FIDO2 is the standards stack that makes phishing-resistant public-key login practical in browsers and apps. Passkeys and hardware keys are how users experience it.
Deploy FIDO2 to raise assurance, then protect enrollment and recovery with the same seriousness as the authenticator itself—because weak fallbacks are how strong cryptography gets bypassed.
Related security terms
Web Authentication API (WebAuthn)
Browser API that websites use to perform FIDO2 ceremonies.
Passkey
User-friendly FIDO credential, often synced across devices.
Hardware Security Key
Roaming authenticator commonly used for FIDO2 MFA.
Phishing-Resistant MFA
Broader control category that FIDO2 exemplifies.
Passwordless Authentication
Login models that FIDO2 enables without reusable passwords.
Frequently asked questions
What is FIDO2 in simple terms?
FIDO2 is a modern login standard where your device proves who you are with a cryptographic key—often unlocked by biometrics or a PIN—so fake websites cannot steal a reusable password or OTP.
What standards make up FIDO2?
WebAuthn (browser/app API) and CTAP (how roaming authenticators such as security keys talk to the client). Together they enable FIDO2 authentication.
Are passkeys part of FIDO2?
Yes. Passkeys are FIDO credentials designed for easier use, often discoverable and syncable across a user’s devices via a platform provider.
Why is FIDO2 phishing-resistant?
Authentication assertions are bound to the relying party’s origin. A lookalike domain cannot obtain a valid signature for the real site.
Do users still need passwords with FIDO2?
Not necessarily. Many deployments are passwordless. Others keep a password as fallback, which can weaken the overall assurance if fallbacks are easy to abuse.
What is the difference between platform and roaming authenticators?
Platform authenticators are built into a device (for example secure enclave + biometrics). Roaming authenticators are separate devices such as USB/NFC security keys.
Is FIDO2 only for employees?
No. It is used for workforce SSO and increasingly for customer login via passkeys, with different UX and recovery designs.
References
Explore authoritative guidance and frameworks related to fido2.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.