Cybersecurity glossary
What is WebAuthn Attestation?
Learn what WebAuthn attestation is, how registration can prove authenticator make and model, privacy trade-offs, attestation types, and when enterprises should require it.
Definition
WebAuthn attestation is optional cryptographic evidence produced during credential registration that can help a relying party verify characteristics of the authenticator—such as manufacturer, model, or certification status—rather than only receiving an anonymous public key.
Why some organizations care which authenticator you used
Passkeys prove possession of a key. They do not always prove the key lives in a particular hardware model. WebAuthn attestation optionally conveys that provenance during registration so enterprises can enforce authenticator allowlists.
For most consumer sites, attestation is unnecessary. For some regulated workforce programs, it is policy-critical.
What attestation adds to registration
RP requests attestation
Registration options ask for direct, enterprise, or other attestation preferences.
Authenticator creates credential
Key pair is generated as usual for the relying party.
Attestation statement formed
Authenticator produces a signed statement about itself and the new key.
RP verifies trust
Server checks format, certificate chain, and metadata allowlists.
Policy decision
Accept, reject, or accept with reduced privilege based on authenticator class.
Common attestation modes
none
No manufacturer proof—maximum privacy and passkey compatibility.
packed / basic
Device-signed attestation using manufacturer credentials.
tpm
Attestation anchored in a Trusted Platform Module.
android-key / safetyNet legacy
Platform-specific Android attestation styles (ecosystem-dependent).
apple anonymization
Apple App Attest / anonymized approaches for privacy-preserving proofs.
enterprise attestation
Organization-scoped attestation for managed authenticators.
When to require vs skip attestation
| Context | Attestation? | Rationale |
|---|---|---|
| Consumer passkeys | Usually skip | Compatibility and privacy |
| Workforce standard users | Optional | Passkeys often enough |
| Privileged admins | Often require | Approved hardware only |
| Regulated inventories | Require + MDS | Prove certified devices |
Implementation checklist
- Default to none attestation unless you have a concrete policy need.
- If required, maintain allowlists via AAGUID and FIDO Metadata Service.
- Verify attestation cryptographically—do not trust client-reported model strings.
- Minimize retention of attestation certificates that could become correlators.
- Communicate clearly to users which security keys are approved.
- Test that synced passkeys still meet your product goals if attestation is strict.
- Separate policies for admin vs standard cohorts.
- Monitor failed attestation as a support and security signal.
The practical takeaway
WebAuthn attestation answers “what kind of authenticator registered?”—not “is this login phishing-resistant?” Origin binding already handles the latter.
Require attestation for controlled enterprise hardware programs; prefer anonymous registration for broad consumer passkey adoption.
Related security terms
WebAuthn Authenticator
Device that may produce attestation during registration.
Web Authentication API (WebAuthn)
API through which attestation objects are returned.
WebAuthn Relying Party
Service that decides whether to require and verify attestation.
Hardware Security Key
Roaming authenticators often used with enterprise attestation policies.
FIDO2
Standards ecosystem that defines attestation formats.
Frequently asked questions
What is WebAuthn attestation in simple terms?
During passkey or security-key setup, the authenticator can optionally prove ‘I am a genuine device of type X’ to the website, not just hand over a public key.
Is attestation required for phishing resistance?
No. Origin-bound signatures provide phishing resistance even with anonymous credentials. Attestation is about knowing which authenticator class was used.
What is ‘none’ attestation?
A common mode where the authenticator/client returns no useful manufacturer proof—often preferred for consumer privacy.
Why do enterprises want attestation?
To allow only approved security keys, meet compliance inventories, or block consumer soft authenticators for admin accounts.
What are privacy concerns?
Unique attestation certificates can correlate registrations across services if misused. Prefer anonymization schemes and clear retention limits.
Should consumer apps require attestation?
Usually no. It reduces compatibility with synced passkeys and adds operational complexity without improving phishing resistance.
What must RPs verify if they require attestation?
Attestation statement format, trust chain to known roots, AAGUID allowlists, and that the attested key matches the registered credential.
References
Explore authoritative guidance and frameworks related to webauthn attestation.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.