Cybersecurity glossary
What is the Web Authentication API (WebAuthn)?
Learn what the Web Authentication API (WebAuthn) is, how browsers create and assert public-key credentials, how it enables passkeys, and security checks relying parties must perform.
Definition
The Web Authentication API (WebAuthn) is a W3C standard browser API that lets web applications register and authenticate users with public-key credentials held by authenticators—forming the web half of FIDO2 passwordless and MFA experiences such as passkeys.
Why browsers needed a public-key login API
Passwords and OTPs are typed secrets. The Web Authentication API (WebAuthn) gives websites a standard way to use device-held private keys instead—enabling passkeys and security keys with origin binding built in.
It is the primary reason phishing-resistant login became mainstream on the web.
Core WebAuthn concepts
Relying Party (RP)
The website that requests registration and authentication.
Authenticator
Platform or roaming device that stores keys and signs challenges.
PublicKeyCredential
Browser object representing the registered credential material.
Challenge
Server-generated random value that prevents assertion replay.
RP ID / origin
Binding that stops credentials from working on lookalike sites.
User verification
PIN/biometric flags proving a human unlocked the authenticator.
Registration and authentication
Server starts a ceremony
Issues options with relying party info, user info, and a fresh challenge.
Browser invokes WebAuthn
navigator.credentials.create or get mediates with the authenticator.
Authenticator performs crypto
Creates a key pair or signs the challenge after user verification.
Credential returned to RP
Attestation or assertion objects are posted to the server.
Server verifies and stores/uses
Validates cryptography and policy; stores public key or opens a session.
Security properties WebAuthn provides
| Property | Meaning | Caveat |
|---|---|---|
| Phishing resistance | Assertions bound to RP ID/origin | Weak recovery can bypass |
| No shared password | Private key never sent to server | Server must store public keys safely |
| Replay resistance | Fresh challenges required | Server must enforce challenge single-use |
| Optional attestation | Know authenticator model | Privacy and compatibility trade-offs |
Implementation checklist
- Generate high-entropy challenges and invalidate them after use or timeout.
- Verify origin, RP ID, signatures, and required UV/UP flags on every response.
- Store credential IDs and public keys per user; protect against credential stuffing of IDs.
- Support platform passkeys and roaming authenticators for coverage.
- Decide attestation policy intentionally for enterprise vs consumer.
- Use maintained WebAuthn server libraries rather than custom crypto parsing.
- Treat authenticator registration and removal as sensitive account events.
- Plan backup credentials and hardened account recovery.
The practical takeaway
WebAuthn is the browser API that makes FIDO passkeys and security-key login possible on the web. It replaces typed secrets with origin-bound signatures.
Call it correctly on the client, verify ruthlessly on the server, and protect recovery—so the phishing resistance of the ceremony is not undone by a weak help-desk reset.
Related security terms
FIDO2
Standards suite pairing WebAuthn with CTAP.
Passkey
User-facing WebAuthn discoverable credential.
WebAuthn Authenticator
Device or platform component that holds private keys.
WebAuthn Relying Party
Website that initiates ceremonies and verifies assertions.
WebAuthn Attestation
Optional proof about authenticator provenance at registration.
Frequently asked questions
What is WebAuthn in simple terms?
It is the browser feature websites use to offer passkey or security-key login. Your device creates a key pair and later signs a challenge instead of sending a password.
Is WebAuthn the same as FIDO2?
WebAuthn is the web API part of FIDO2. CTAP covers how external authenticators talk to the platform.
What are the two main ceremonies?
create() (registration/attestation of a new credential) and get() (authentication/assertion with an existing credential).
Does WebAuthn send biometrics to the website?
No. Biometrics unlock the local authenticator. The site receives a cryptographic assertion, not fingerprint images.
What must servers verify?
Challenge match, origin/RP ID binding, signature validity, sign-count where applicable, and user verification flags required by policy.
Can WebAuthn work cross-device?
Yes via platform hybrid transports (for example QR-based phone approval) depending on OS and browser support.
Is WebAuthn only for passwordless?
It supports passwordless primary authentication and second-factor modes, depending on how credentials are created and requested.
References
Explore authoritative guidance and frameworks related to web authentication api (webauthn).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.