Passwordless Authentication System Using Webauthn And Fido2 — Complete Documentation & Simulation

Overview & System Context

Passwordless Authentication System Using Webauthn And Fido2: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~9510 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background Passwordless authentication is an authentication method in which a user can log in to a computer system without entering (and having to remember) a password or any other knowledge-based secret. In most common implementations, users are asked to enter their public identifier (username, phone number, email address, etc.) and then complete the authentication process by providing a secure proof of identity through a registered device or token. Passwordless authentication methods typically rely on public-key cryptography infrastructure, where the public key is provided during registration to the authenticating service (remote server, application, or website). In contrast, the private key is kept on a user’s device (PC, smartphone or an external security token) and can be accessed only by providing a biometric signature or another authentication factor which is not knowledge-based. These factors classically fall into two categories: Ownership factors (“Something the user has”) such as a cellular phone, OTP token, smart card, or a hardware token.

Inherence factors (“Something the user is”) like fingerprints, retinal scans, face or voice recognition and other biometric identifiers. Some designs might also accept a combination of other factors such as geo-location, network address, behavioral patterns, and gestures, as long as no memorized passwords are involved. Passwordless authentication is sometimes confused with multi-factor authentication (MFA), since both use a wide variety of authentication factors. Still, while MFA is often used as an added layer of security on top of password-based authentication, passwordless authentication does not require a memorized secret. Usually, it uses just one highly secure factor to authenticate identity (i.e., an external security token), making it faster and simpler for users. When both approaches are employed, “Passwordless MFA” is the term used.

The authentication flow is passwordless and uses multiple factors, providing the highest security level when implemented correctly. Registration request: When a user attempts to register with a website, the server sends a registration request to the user's device. Authentication factor selection: When the user's device receives the registration request, it sets up a method for authenticating the user. For example, the device may use biometrics like a fingerprint scanner or facial recognition for user identification. Key generation: The user's device generates a public/private key pair and sends the public key to the server for future verification. Once they have registered, a user can log in to the system via the following process: Authentication challenge: The server sends an authentication challenge to the user's device when the user attempts to log into the site. User authentication: The user proves their identity to their device using the biometric scanner, unlocking their private key. Challenge response: The user's device digitally signs a response to the authentication challenge with the user's private key. Response validation: The server uses the user's public key to verify the digital signature and provides access to the user's account.

Figure 1: Beyond Passwords: FIDO2 and WebAuthn in Practice - inovex GmbH Greater security – passwords are known to be a weak point in computer systems (due to reuse, sharing, cracking, spraying etc.) and are regarded a top attack vector responsible for a huge percentage of security breaches. Better user experience – Not only users aren’t required to remember complicated password and comply with different security policies, they are also not required to periodically renew passwords. Reduced IT costs – since no password storage and management is needed IT teams are no longer burdened by setting password policies, detecting leaks, resetting forgotten passwords, and complying with password storage regulation. Better visibility of credential use – since credentials are tied to a specific device or inherent user attribute, they can't be massively used and access management becomes more tight. Scalability – managing multiple logins without additional password fatigue or complicated registration. While others point out operational and cost-related disadvantages: Implementation costs – Although it is accepted that passwordless authentication leads to savings in the long term, deployment costs are currently a hindering factor for many potential users. Cost is associated with the need to deploy an authentication mechanism on an existing user directory and sometimes the additional hardware deployed to users (e.g. OTPs or security keys). Training and expertise needed – while most password management systems are built similarly and have been used for many years, passwordless authentication requires adaptation from both IT teams and end users. Single point of failure – particularly implementations using OTP or push notifications to cellular device applications can create a challenge for the end user if a device is broken, lost, stolen or simply upgraded.

Web Authentication (WebAuthn) is a web standard published by the World Wide Web Consortium (W3C). It defines an API that websites use to authenticate with WebAuthn credentials (commonly known as passkeys) and outlines what WebAuthn authenticators should do. It solves many of the issues of traditional password-based authentication by verifying the user's identity with digital signatures. Although WebAuthn is often touted as a complete replacement for passwords, most websites that implement it continue to use passwords in some capacity. To use WebAuthn, users require a compatible authenticator.

The standard does not specify how to store the keys required for signing, so a variety of authenticator types can be used. The most common authenticator type is a platform authenticator, which is built into the operating system of the device. Common platform authenticators include Android, Apple Keychain and Windows Hello. These make use of hardware security features (such as TEE and TPM), and often sync credentials between devices for ease-of-use. Another common authenticator type is a roaming authenticator, where a separate hardware device authenticates the user by connecting over USB, Bluetooth Low Energy, or near-field communications (NFC). Most smartphones can be used as roaming authenticators, and dedicated physical security keys are also used. WebAuthn is effectively backward compatible with FIDO Universal 2nd Factor (U2F) as they both use the CTAP protocol. Password managers can also be used as an authenticator, often with cloud sync. Where credentials sync is not viable or possible, WebAuthn Hybrid Transport can be used to access credentials stored on another authenticator such as a smartphone. Like legacy U2F, WebAuthn is resistant to some phishing attacks as the authenticator only offers credentials that were registered on the same website. However, unlike U2F, WebAuthn can be implemented in a passwordless manner. Moreover, a roaming hardware authenticator resists malware, since the keys are stored on a separate device, which prevents the malware from accessing them directly. The WebAuthn Level 1 and 2 standards were published as W3C Recommendations on 4 March 2019 and 8 April 2021 respectively. A Level 3 specification progressed through several Candidate Recommendation Snapshots during 2026, and in July 2026 the W3C proposed advancing it to full Recommendation status.

Passkey is the de facto non-technical term for a saved sign-in credential, a piece of cryptographic information that is capable of being used to authenticate a user using the WebAuthn standard. Most user interfaces that support using WebAuthn refer to it as supporting passkeys. Due to the open-ended nature of the WebAuthn specification, a passkey can be stored on software or hardware that is capable of authenticating a user. This includes technology like Windows Hello which works by using facial recognition to authenticate users, Bitwarden which authenticates users through a browser extension or YubiKeys that allow a user to authenticate using a physical hardware token. The cryptographic keys stored by the software are only available to use for the browser once the software or hardware is authenticated the user. When Apple first prominently introduced passkeys to the public in 2022, they emphasized integrations with their own products. This, combined with the lack of clear communication from other companies, led to speculation that passkeys were proprietary to Apple. As browsers and websites began to implement WebAuthn, the inconsistent feature-sets have often resulted in a variety of understandings of what exactly counted as a passkey.

Figure 2: FIDO2 Passwordless Authentication With Keycloak - Part 2 | RefactorFirst The website is a conforming WebAuthn Relying Party The browser is a conforming WebAuthn Client The authenticator is a FIDO2 authenticator, that is, it is assumed compatible with the WebAuthn Client WebAuthn specifies how a claimant demonstrates possession and control of a FIDO2 authenticator to a verifier called the WebAuthn Relying Party. The authentication process is mediated by an entity called the WebAuthn Client, which is little more than a conforming web browser.

Authenticator is a multi-factor cryptographic authenticator that uses public-key cryptography to sign an authentication assertion targeted at the WebAuthn Relying Party. Assuming the authenticator uses either a facial recognition, fingerprint or PIN for user verification, the authenticator itself is something you have while the facial recognition and fingerprint (biometric) are something you are and the PIN is something you know. To initiate the WebAuthn authentication flow, the WebAuthn Relying Party indicates its intentions to the WebAuthn Client (i.e., the browser) via JavaScript. The WebAuthn Client communicates with the authenticator using a JavaScript API implemented in the browser. A roaming authenticator conforms to the FIDO Client to Authenticator Protocol (CTAP), and connected over USB, Bluetooth Low Energy, or near-field communications (NFC). WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (e.g., implemented on a smartphone) or a platform authenticator (i.e., an authenticator implemented directly on the WebAuthn Client Device) may be used. Relevant examples of platform authenticators include Windows Hello and the Android operating system. WebAuthn Hybrid Transport allows the WebAuthn Client to access credentials stored on another authenticator such as a smartphone, useful in certain situations where credential sync is not viable. There is a lingering misunderstanding among users that biometric data is transmitted over the network in the same manner as passwords, which is not the case.

The WebAuthn Level 1 standard was published as a W3C Recommendation by the Web Authentication Working Group on 4 March 2019. WebAuthn is supported by Google Chrome, Mozilla Firefox, Microsoft Edge, Apple Safari and Opera. The desktop version of Google Chrome has supported WebAuthn since version 67. Firefox, which had not fully supported the previous FIDO U2F standard, included and enabled WebAuthn in Firefox version 60, released on 9 May 2018. An early Windows Insider release of Microsoft Edge (Build 17682) implemented a version of WebAuthn that works with both Windows Hello as well as external security keys. Existing FIDO U2F security keys are largely compatible with the WebAuthn standard, though WebAuthn added the ability to reference a unique per-account "user handle" identifier, which older authenticators are unable to store. One of the first FIDO2-compatible authenticators was the second-generation Security Key by Yubico, announced on 10 April 2018. The first FIDO2-compatible authenticators with a display was Trezor Model T by SatoshiLabs, announced on 6 November 2019. Trezor Model T was also the first authenticator that allowed users to select which FIDO2 resident credential should be used directly on a device. The first Security Level 2 certified FIDO2 key, called "Goldengate" was announced one year later by eWBM on 8 April 2019. Dropbox announced support for WebAuthn logins (as a 2nd factor) on 8 May 2018. Apple announced that Face ID or Touch ID could be used as a WebAuthn platform authenticator with Safari on 24 June 2020. Several password managers such as Bitwarden and Dashlane support WebAuthn.

Through the mandated use of COSE (RFC 8152) WebAuthn also supports RSA with PKCS1v1.5 padding. This particular scheme of padding has been known to be vulnerable to specific attacks for at least twenty years, and it has been successfully attacked in other protocols and implementations of the RSA cryptosystem in the past. It is difficult to exploit under given conditions in the context of WebAuthn, but since there are more secure cryptographic primitives and padding schemes, it is still a bad choice and cryptographers no longer consider it best practice. The FIDO Alliance standardized on the asymmetric cryptographic scheme ECDAA. This is a version of direct anonymous attestation based on elliptic curves and in the case of WebAuthn is used to verify the integrity of authenticators, while also preserving the privacy of users, as it does not allow for global correlation of handles. However, ECDAA does not incorporate some of the lessons that were learned in the last decades of research in the area of elliptic curve cryptography, as the chosen curve has some security deficits inherent to this type of curve, which reduces the security guarantees quite substantially. Furthermore, the ECDAA standard involves random, non-deterministic signatures, which already has been a problem in the past. Paragon Initiative Enterprises also criticized how the standard was initially developed, as the proposal was not made public in advance and experienced cryptographers were not asked for suggestions and feedback. Hence the standard was not subject to broad cryptographic research from the academic world. Despite these shortcomings, Paragon Initiative Enterprises still encourage users to continue to use WebAuthn but have come up with some recommendations for potential implementers and developers of the standard that they hope can be implemented before the standard is finalized. Avoiding such mistakes as early as possible would protect the industry from any challenges that are introduced by broken standards and the need for backwards compatibility. ECDAA was only designed to use in combination with device attestation. This particular feature of WebAuthn is not necessarily required for authentication to work. Current implementations allow the user to decide whether an attestation statement is sent during the registration ceremony. Independently, relying parties can choose to require attestation or not. ECDAA was removed from WebAuthn Level 2 as it was not implemented by browsers nor relying parties.

Figure 3: Passwordless Authentication with WebAuthn on Keycloak | Cloud-IAM | DOCS Passkey, also known as security key, is a pair of cryptographic keys that is generated by a user's authenticator linked to an account to authenticate a user's identity against a remote application or system by using public-key cryptography, thus avoiding the need to reveal the secret key held by the user through public channels. The current popular implementation of passkeys for general public usage in web technologies is proposed by FIDO Alliance and standardised by the World Wide Web Consortium under the WebAuthn standard, and passkeys is generally referred as a de-facto non-technical term of WebAuthn credential.

FIDO2 passkeys are commonly used by web technologies such as mobile apps and websites for user authentication. This is done by allowing applications to request a challenge from the device client (e.g. web browser or operating system) through WebAuthn, and then the device client relaying to the hardware carrying out the cryptographic operation through CTAP2. The use of the term passkey to refer to the private key/user credential starts in June 2022, where Apple announces that they will start to support passkeys as an authentication method in iOS and macOS devices, debuting the term "passkey" to the general public. Google announced in October 2022 that Android and Google Chrome would support passkeys, followed by Microsoft on Windows 11 in September 2023. Some implementations of WebAuthn passkeys allow storage of user identifiers inside the passkey itself, allowing users to directly authenticate as the defined identity instead of providing an identifier (such as email or username) separately. Other implementations of WebAuthn passkeys acts as part of multi-factor authentication, requiring additional authentication methods such as password or email verification to be used together.

Troy Hunt: "Passkeys are one of the few security constructs that make your life easier, rather than harder." "That's a one-click sign-in, and clicking the purple button immediately grants me access to my account." Dan Goodin: "Passkey technology is elegant, but it’s most definitely not usable security." Bruce Davie: "...the implementation seems to have failed the 'make it easy for users' test, which in my view is the whole point of passkeys. I have been using public key cryptography for 30-plus years...

If I find passkeys confusing to use, it doesn’t bode well for more typical users." The FIDO Alliance has published three sets of specifications for simpler, stronger user authentication: FIDO Universal Second Factor (FIDO U2F), FIDO Universal Authentication Framework (FIDO UAF) and the Client to Authenticator Protocols (CTAP). CTAP is complementary to the W3C’s Web Authentication (WebAuthn) specification ; together, they are known as FIDO2.

FIDO standards use standard public key cryptography techniques to provide phishing-resistant authentication with cryptographic key pairs called passkeys . FIDO is designed from the ground up to protect user privacy and prevent phishing. Every passkey is unique and bound to the online service domain. The protocols do not provide information that can be used by different online services to collaborate and track a user across the services. Biometric information, if used, never leaves the user’s device.

Read the technical specifications on the specifications download page . In addition to meeting the technical requirements, the FIDO Alliance developed further security requirements that need to be implemented to enhance the security assurance of each device. These requirements are covered in the Authenticator Certification program found on the Authenticator Security Levels page.

FIDO2 is comprised of the W3C Web Authentication specification and corresponding Client-to-Authenticator Protocols ( CTAP ) from the FIDO Alliance. FIDO2 supports passwordless , second-factor and multi-factor user experiences with embedded (or bound) authenticators (such as biometrics or PINs) or external (or roaming) authenticators (such as FIDO Security Keys, mobile devices, wearables, etc.).

WebAuthn defines a standard web API that is being built into browsers and platforms to enable support for FIDO Authentication. CTAP2 allows the use of external authenticators (FIDO Security Keys, mobile devices) for authentication on FIDO2-enabled browsers and operating systems over USB, NFC, or BLE for a passwordless, second-factor or multi-factor authentication experience.

The new name for FIDO U2F, CTAP1 allows the use of existing FIDO U2F devices (such as FIDO Security Keys) for authentication on FIDO2-enabled browsers and operating systems over USB, NFC, or BLE for a second-factor experience. FIDO UAF supports a passwordless experience. WIth FIDO UAF, the user carries a device with a FIDO UAF stack installed. They can then register their device to the online service by selecting a local authentication mechanism such as swiping a finger, looking at the camera, speaking into the mic, entering a PIN, etc. The FIDO UAF protocol allows the service to select which mechanisms are presented to the user.

Once registered, the user simply repeats the local authentication action whenever they need to authenticate to the service. The user no longer needs to enter their password when authenticating from that device. FIDO UAF also allows experiences that combine multiple authentication mechanisms such as fingerprint + PIN. FIDO U2F supports a second-factor experience. FIDO U2F allows online services to augment the security of their existing password infrastructure by adding a strong second factor to user login. The user logs in with a username and password as before. The service can also prompt the user to present a second factor device (such as a FIDO Security Key) at any time it chooses. The strong second factor allows the service to simplify its passwords (e.g. 4–digit PIN) without compromising security.

During registration and authentication, the user presents the second factor by simply pressing a button on a USB device or tapping over NFC or BLE. The user can use their FIDO U2F device across all online services that support the protocol leveraging built–in support in web browsers. Receive the latest news, events, research and implementation guidance from the FIDO Alliance. Learn about digital identity and fast, phishing-resistant authentication with passkeys.

The transition from passwords to passwordless authentication is not merely a UX improvement; it is a fundamental architectural shift in how we handle identity. In a traditional password system, the server stores a hash of a secret shared between the user and the site. If that database is breached, attackers can attempt offline cracking or reuse the credentials elsewhere. In a passwordless system built on FIDO2 and WebAuthn, the server never sees, stores, or knows the secret.

Instead, the server stores a public key, and the secret (private key) resides exclusively on the user's device. The security guarantee comes from the cryptographic binding of that key to a specific origin, making credential theft via phishing mathematically impossible. To understand why passwordless is resistant to phishing, we must look at the rpId (Relying Party Identifier) mechanism defined in the WebAuthn specification. When a user registers a credential, the authenticator (the device) records the rpId as part of the credential's metadata. This ID is usually the registered domain or its parent domain (e.g., example.com ).

During the registration or authentication process, the browser sends a clientDataJSON object to the authenticator. This JSON includes the origin (the exact URL the user is visiting) and the rpId . The authenticator checks if the requesting origin matches the stored rpId . If a user is tricked into visiting evil-example.com while their key was registered for example.com , the authenticator refuses to sign the request because the origins do not match. This mechanism ensures that a stolen credential cannot be used on a different domain, even if the attacker has the user's device.

The server must enforce this by setting the rpId correctly in the challenge request. If the server passes rpId: "example.com" but the user is on sub.example.com , the browser handles the resolution, but the server must ensure the challenge is scoped correctly. Registration is the moment the trust relationship is established. Unlike a password system where the user types a secret and the server hashes it, the WebAuthn registration flow relies on the client generating a key pair locally. The authenticator creates a new asymmetric key pair (e.g., ECDSA or RSA). The private key is generated within the secure hardware boundary of the device (TPM, Secure Enclave, or Trusted Platform Module) and is never exposed to the operating system or the network.

2. System Architecture & Core Working Principles The client receives the createCredential command from the browser. The authenticator signs the attestation statement using the Attestation Private Key (APK) provided by the manufacturer (for direct attestation). If the attestation level is set to none , the authenticator produces no signature, and the server trusts the key generation without verifying the device manufacturer's signature. It is crucial to distinguish between the credential private key (used for authentication) and the attestation private key (used for proving the device's origin).

The server receives the attestationObject and the clientDataJSON . It must verify the signature chain. If attestation is set to none , the server trusts the key generation without verifying the device manufacturer's signature. If set to direct or indirect , the server validates the attestation certificate chain to ensure the key came from a genuine, trusted authenticator. Crucially, the server stores only the publicKey , the credentialId , and the counter . The counter is vital for detecting replay attacks. If a user authenticates and the counter value returned by the authenticator is less than or equal to the last recorded counter, the server rejects the request, indicating the key might be cloned or replayed.

Authentication is a challenge-response protocol. The server generates a fresh, random nonce (the challenge) and sends it to the client. The client passes this challenge to the authenticator. The authenticator retrieves the private key associated with the credentialId provided by the user. The critical step here is the signing operation. The authenticator constructs a data structure containing the challenge, the RP ID, and the origin. It signs this structure with the private key. The resulting signature is returned to the server along with the clientDataJSON .

If any of these checks fail, the authentication is rejected. This flow ensures that the user possesses the private key and that the request originates from the expected domain. This robust architecture forms the backbone of modern passwordless security. Passkeys represent the evolution of FIDO2 by solving the "device loss" problem without compromising security. In a standard FIDO2 setup, if a user loses their phone or laptop, the private key is lost, and the credential is gone. Passkeys introduce a cloud-backed synchronization layer.

When a user enables passkeys on an iOS device, the private key is encrypted using a device-specific key and a user-derived key. This encrypted blob is uploaded to the cloud (e.g., iCloud Keychain). When the user logs in on a new device, the cloud provides the encrypted private key to the new device. The new device decrypts it using the user's biometric or PIN, effectively "transferring" the key.

This process maintains the security properties of FIDO2. The private key never travels in plaintext over the network. The synchronization relies on the end-to-end encryption provided by the operating system's keychain. The attestation in this context often includes a "cross-device" flag, indicating that the credential is backed up. However, this introduces a dependency on the cloud provider's security model. If the cloud provider's encryption keys are compromised, the private keys could theoretically be decrypted. This is a trade-off between convenience and the "air-gapped" nature of local-only FIDO2 keys. For most enterprise and consumer applications, the risk profile of cloud-synced passkeys is significantly lower than the risk of lost passwords or stolen password databases.

The implementation requires the server to handle the credentialBackup and credentialBackupState flags in the authenticatorData . If credentialBackup is true, the server knows the key exists on multiple devices. If a user reports a lost device, the server invalidates the credential ID on the relying party side, and the cloud provider's sync mechanism ensures the revoked credential is removed from all synced devices or devices detect the invalidation.

This seamless integration makes passwordless login a viable replacement for traditional methods, offering both high security and user convenience. Implementing passwordless authentication via FIDO2 and WebAuthn removes the entire class of vulnerabilities associated with password storage, transmission, and reuse. By shifting the secret to the user's device and binding it cryptographically to the origin, we eliminate the possibility of phishing attacks stealing credentials. The mechanism relies on asymmetric cryptography, where the public key is stored on the server and the private key is protected by hardware.

While passkeys add the complexity of cloud synchronization, they preserve the core security model while solving the usability issue of lost devices. The implementation requires careful attention to the rpId , challenge generation, and counter validation. As the industry moves away from passwords, the adoption of these standards will become the baseline for secure identity management.

Implementing passwordless systems introduces specific challenges that differ significantly from traditional password management. Q: Can users still be phished with passwordless authentication? A: While passwordless authentication is highly resistant to phishing due to origin binding, it is not immune to sophisticated attacks like Man-in-the-Middle (MitM) proxies that can intercept the challenge. However, the WebAuthn spec includes protections against this by binding the signature to the origin and the challenge, making such attacks significantly harder to execute than with passwords.

Q: What happens if my cloud provider goes down? A: If the cloud provider (e.g., iCloud, Google Password Manager) is unavailable, users may be unable to sync passkeys to new devices or recover lost ones. However, existing passkeys on the user's primary device will continue to work, as the private key resides locally on that device. Q: Is passwordless authentication slower than passwords? A: Generally, no. Passwordless login often feels faster because it eliminates the need to type complex passwords, retrieve them from a manager, or type two-factor codes. The interaction relies on biometrics or device PINs, which are near-instantaneous.

An examination of FIDO2 and WebAuthn standards for implementing phishing-resistant authentication and secure credential management. A walkthrough for configuring WebAuthn and passkeys within Keycloak to enable passwordless authentication using FIDO2 standards.

A technical guide to implementing passkeys across Google, Apple, and Microsoft ecosystems using WebAuthn for cross-device synchronization. TL;DR — WebAuthn enables passwordless authentication by leveraging device-bound credentials and public-key cryptography, eliminating password reuse risks while improving user experience across browsers and platforms. This guide walks through the full flow, from client credential creation to secure server verification, with production-ready patterns and common pitfalls.

Passwordless authentication is no longer a futuristic ideal — it’s a deployable reality. WebAuthn, standardized by the W3C and FIDO Alliance, provides a browser- and OS-native API for creating and using public-key credentials that never leave the authenticating device. Unlike OTPs or SMS-based 2FA, WebAuthn credentials are phishing-resistant, unshareable, and tied to the specific relying party that issued them. In this article, we’ll dissect the protocol flow, examine client and server implementations, and highlight the operational considerations that separate a hobbyist demo from a production-grade deployment.

WebAuthn operates as the web-facing portion of the broader FIDO2 standard. The specification defines two primary APIs: navigator.credentials.create() for registering a new credential and navigator.credentials.get() for authenticating an existing one. Under the hood, WebAuthn relies on the Client-to-Authenticator Protocol (CTAP) to communicate with authenticators—ranging from built-in biometric sensors (fingerprint, face ID) to external USB/NFC security keys.

WebAuthn handles the browser-to-website communication, while CTAP bridges the browser to the actual authenticator hardware. When a user registers a fingerprint on their laptop, the browser invokes WebAuthn to generate a key pair and associated metadata; CTAP then forwards the cryptographic operations to the authenticator via USB, Bluetooth, or NFC. This separation allows the same WebAuthn API to work across diverse device types, from TPM-backed laptops to iOS Safari with Face ID to Android with Fingerprint API.

Understanding these terms is essential when interpreting the attestation object your server receives or when configuring RP IDs for multi-tenant deployments. The most common stumbling block for developers is constructing the correct PublicKeyCredentialCreationOptions dictionary. Below is a minimal, production-relevant example in JavaScript: Browser and OS Support as of 2024 covers approximately 94% of global desktop and mobile browsers. Safari on iOS and macOS has supported WebAuthn since version 13.1, with residentKey and userVerification options stabilized in recent releases. Android’s FIDO2 support has been available since API level 28 via the FIDO2 client library.

Pinning and User Verification is a critical configuration. Setting userVerification: "required" ensures that the authenticator requires some form of user presence (PIN, biometric, or touch), which directly mitigates credential theft via malware that can bypass pure presence checks. However, requiring verification on every enrollment can increase drop-off rates; many services use "preferred" for initial registration and "required" for high-risk actions like changing authentication methods.

On the server, the WebAuthn verification flow follows a strict sequence. The server must validate the client data hash, the authenticator data, and the signature—any deviation invalidates the assertion. The authenticatorData byte array contains several flags and values your server must check: When a new credential is created, the authenticator may return an attestation object containing signed data about the authenticator’s make, model, and firmware version. Common attestation formats: 3. Software Implementation, Frameworks & Protocols Many production services opt for “None” attestation to avoid vendor lock-in and privacy concerns, relying instead on the cryptographic uniqueness of the public key itself. If you do validate attestation, ensure you build or consume a reputable attestation root store; maintaining one from scratch is error-prone and often unnecessary.

A frequent mistake is storing the entire credential object or the raw public key verbatim. Instead, store only: Never store the private key—it never leaves the authenticator. The credential.id serves as your lookup key to associate the credential with a user account. Additionally, store the transports array (e.g., ["usb", "nfc"] ) if you need to support credential migration across devices.

Greenfield projects can adopt WebAuthn exclusively, but brownfield applications typically benefit from a phased approach. A common pattern is the “passwordless-first” flow: the user’s primary login remains password-based, but they can opt to add a WebAuthn credential as a secondary method. Once enrolled, subsequent logins can check for a valid WebAuthn assertion before falling back to the password prompt. This reduces support load and provides immediate value to early adopters.

One of WebAuthn’s more nuanced features is residentKey , which controls whether a credential is platform-bound (stored in TPM/secure element) or roaming (exportable via FIDO2 cloud sync). Setting residentKey: "preferred" allows the authenticator to decide; if the device supports cloud-synced credentials (e.g., iCloud Keychain, Google Password Manager), the user can recover their credentials on a new phone. If set to "required" , the credential remains tightly bound to the original hardware, simplifying revocation but complicating device transitions.

WebAuthn was designed with privacy as a first principle. The rpId check ensures a credential cannot be used across different domains, and the user.id is opaque to anyone except your server. However, be cautious about logging or exposing credential identifiers in URLs or analytics. Treat credential.id as sensitive data—it uniquely identifies a user’s authenticator and, combined with other leaks, could aid fingerprinting.

Passwords are the oldest and weakest link in authentication. They are phishable, reusable, guessable, and expensive to manage. The average enterprise spends 30-50% of its help-desk budget on password resets. Credential stuffing attacks exploit the fact that users reuse passwords across sites. Even sophisticated password policies cannot eliminate the fundamental problem: secrets that humans must remember and type are inherently vulnerable.

Passwordless authentication eliminates passwords entirely, replacing them with cryptographic credentials that are bound to the user's device, cannot be phished, and require no memorization. With the maturation of FIDO2, WebAuthn, and passkeys, passwordless is no longer experimental. It is production-ready and rapidly becoming the standard. This guide walks you through implementing passwordless authentication, from understanding the underlying protocols to deploying passkeys across your organization.

Passkeys are a user-friendly evolution of FIDO2 credentials. They are WebAuthn credentials that are synced across the user's devices via the platform's cloud (iCloud Keychain for Apple, Google Password Manager for Android/Chrome). This solves the key recovery problem that plagued earlier FIDO2 deployments. For enterprise environments, the recommended approach is: synced passkeys as the default for most users, hardware security keys for high-privilege accounts (admins, executives), and platform authenticators as a middle ground.

Use a well-tested library like @simplewebauthn/server (Node.js), py_webauthn (Python), or webauthn-rs (Rust) rather than implementing the cryptographic verification yourself. Phase 1, Passwordless as an option (Months 1-3): Users can register a passkey alongside their existing password. Promote passkey registration through in-app prompts and communications.

Phase 2, Passwordless preferred (Months 4-6): Default the login page to passkey authentication. Users can still click "Sign in with password" as a fallback. Track adoption metrics. Phase 3, Passwordless enforced (Months 7-12): For groups with high adoption (>90%), disable password login. High-privilege users (admins) must use hardware security keys. Maintain a break-glass password reset process.

Phase 4, Password elimination (Month 12+): Remove password fields from the database. Passwords no longer exist in your system. Passwordless authentication is the most significant improvement in authentication security in decades. By eliminating passwords, you eliminate phishing, credential stuffing, password spraying, and password reuse, attack vectors that account for the majority of breaches.

The technology is mature, the standards are finalized, and the user experience is superior to passwords. The main challenge is organizational: migrating users, supporting diverse devices, and handling edge cases. By following the phased migration approach outlined in this guide and supporting multiple authenticator types, you can transition your organization to passwordless with minimal disruption.

Q: What happens if a user loses their phone? A: If the user registered a synced passkey, their credential is available on any other device signed into the same cloud account. If they registered a device-bound credential, they need a backup authenticator (e.g., security key) or must go through account recovery. Q: Are passkeys secure enough for enterprise use? A: Yes. Passkeys are phishing-resistant, cannot be reused across sites, and require user verification (biometric or PIN). For the highest security roles, supplement synced passkeys with device-bound hardware security keys.

Q: Can I use WebAuthn without an IdP? A: Yes. You can implement WebAuthn directly in your application using a server library. However, using an IdP simplifies credential management and provides a centralized authentication experience across multiple applications. Q: Do passkeys work on shared computers? A: Platform passkeys on shared computers are problematic because they are tied to the OS user profile. Use roaming authenticators (security keys) or QR-code-based cross-device authentication for shared workstations.

Q: What about users who cannot use biometrics? A: WebAuthn authenticators support PIN as an alternative to biometrics. Users with accessibility needs can enter a PIN instead of scanning a fingerprint. Hardware security keys also support PIN-based user verification. Biometric authentication confirms a person by comparing a live measurement of a physical characteristic, such as a fingerprint or face, against a template captu A step-by-step guide to implementing identity federation covering SAML, OIDC, and WS-Federation protocols, trust relationship configuration, attribute mapping, A complete guide to implementing multi-factor authentication, comparing MFA methods, deploying phishing-resistant MFA, balancing security with user experience, Not all passwordless is equal. A practical strategy for choosing between magic links, OTP, and passkeys by threat model, rolling them out in the right order, an RSA ID Plus now covers Linux servers, developer workstations, and critical infrastructure with FIDO-based passwordless sign-in, closing the gap where organizati Compare the leading passwordless authentication platforms in 2026, from HYPR and MojoAuth to Passage by 1Password and Descope, with features, architecture, and FIDO2 is a collection of authentication standards developed by the FIDO Alliance and in collaboration with the World Wide Web Consortium (W3C). It enables passwordless authentication through the use of public-key cryptography, improving both security and user convenience. FIDO2 builds on FIDO consists of two key components: the WebAuthn API and the Client to Authenticator Protocol (CTAP).

WebAuthn (Web Authentication) is a W3C standard that defines a browser-based API for creating and using public-key credentials. It allows users to authenticate using devices like security keys, smartphones, or built-in biometric systems (e.g., fingerprint readers), without relying on passwords. By pairing a user’s device with the online service through cryptographic methods, WebAuthn ensures that private keys remain securely stored on the device, protecting them from server-side breaches.

4. Practical Deployment, Analysis & Case Studies Together, FIDO2 and WebAuthn provide a scalable and secure alternative to traditional password-based systems, enabling a passwordless setup across web applications and online services. Initially, passwords were considered sufficient for securing online accounts. However, the growing frequency of data breaches, phishing attacks, and credential stuffing revealed their weaknesses. Passwords can be easily guessed, stolen, or reused across multiple sites, creating a significant security risk.

To mitigate these issues, multi-factor authentication (MFA) was introduced, requiring users to verify their identity using two or more factors, such as something they know (a password), something they have (a security token), or something they are (a biometric identifier). While MFA increased security, it added complexity to the user experience. The advent of FIDO standards, including FIDO2, marked a shift toward passwordless authentication. By leveraging public-key cryptography, FIDO2 eliminates the need for shared secrets like passwords. Instead, users authenticate with unique private keys stored securely on their devices, paired with public keys registered with online services.

This approach improves security and simplifies the authentication process, making it faster and more user-friendly. Passwordless authentication is rapidly gaining adoption as organizations recognize its ability to reduce friction for users while offering protection against modern threats. The FIDO Alliance, formed in 2012, is a consortium focused on improving security standards for online authentication.

Comprising tech companies, service providers, and others, FIDO develops specifications that promote the adoption of universal, interoperable authentication solutions. Their primary goal is to reduce reliance on passwords by offering more thorough methods to ensure secure access to online applications and services. FIDO standards—FIDO UAF, FIDO U2F, and FIDO2—cater to a range of scenarios by implementing public-key cryptography for secure authentication. They ensure that users can log in to various services without the need for passwords, minimizing risks associated with password breaches.

FIDO2 and WebAuthn are closely related but distinct components of the FIDO standards. While WebAuthn is a critical part of the FIDO2 framework, FIDO2 includes additional elements necessary for implementing passwordless authentication. Here’s a breakdown of how FIDO2 works, including the roles of WebAuthn and other key elements: FIDO2 relies on public-key cryptography to authenticate users securely. When a user registers with a service, their device generates a unique pair of keys: a private key that remains on the device and a public key shared with the service.

Authentication is completed by proving possession of the private key, typically through user verification such as a biometric scan or PIN. This eliminates the need for shared secrets like passwords and ensures that private keys never leave the user’s device. Anthony Dombrowski is a product manager and developer advocate with expertise in developer experience, cybersecurity, and product strategy. He has led initiatives at Ping Identity and DevNetwork to enhance developer tools, authentication processes, and user experiences.

Anthony Dombrowski is a product manager and developer advocate with expertise in developer experience, cybersecurity, and product strategy. He has led initiatives at Ping Identity and DevNetwork to enhance developer tools, authentication processes, and user experiences. FIDO2 improves security by utilizing public-key cryptography, eliminating the storage of sensitive data like passwords on servers. This reduces the risk of breaches and credential theft. In traditional systems, passwords are vulnerable to brute force attacks , whereas FIDO2’s reliance on cryptographic keys ensures protection. Attackers cannot gain access without the private key, which stays securely on the user’s device.

Additionally, FIDO2 provides strong resistance against phishing attacks. Since keys are bound to the web origin, authenticators cannot be tricked by fraudulent sites into revealing information, significantly elevating security standards. With FIDO2, users don’t need to remember complex passwords or deal with frequent password resets. Instead, authentication can be as simple as a touch, glance, or inserting a security key, making the authentication process faster. This is especially advantageous in environments where quick but secure access is essential.

FIDO2’s flexibility in supporting different authenticators, including biometrics and hardware keys, caters to individual preferences, improving the user experience. The uniformity and ease of using familiar devices across multiple platforms simplify the login process, making security seamless and less burdensome. FIDO2’s architecture provides inherent resistance against phishing attacks, a significant improvement from traditional authentication systems. By using site-specific key pairs, FIDO2 ensures that credentials are not reusable across different domains, making it impossible for attackers to use phishing techniques to access sensitive information.

This domain-specific operation effectively nullifies the threat of false sites deceiving users into surrendering credentials. Additionally, automated processes within FIDO2 ensure users directly connect to the legitimate origin, eliminating human error in recognizing fraudulent sites. This framework prevents credential interception across networks, preventing phishing SMEs exploit.

FIDO2 improves privacy by not storing sensitive information on servers. The decentralized nature of storing private keys directly on user devices ensures that personal data cannot be easily extracted or misused. This privacy-centric approach complies with stringent data protection regulations and user expectations for confidentiality in digital transactions. FIDO2 accommodates a range of devices and platforms, enabling interoperability and scalability. Its universal framework supports diverse authentication scenarios, allowing organizations to implement FIDO2 consistently across various services.

Although FIDO2 WebAuthn is highly secure, combining it with other security measures can create a stronger authentication framework, particularly in high-risk environments. For example, network-based controls like IP allowlisting or device-trust assessments can complement WebAuthn by ensuring that only pre-approved networks or devices are permitted to access the service.

Behavioral analytics can also help, flagging unusual patterns, such as login attempts from unfamiliar locations or at atypical times. In corporate environments, WebAuthn can integrate with centralized identity and access management (IAM) systems, adding an extra layer of control. This multi-layered approach helps mitigate risks not addressed by cryptographic protections. Organizations that are not ready to fully adopt passwordless authentication can still benefit from FIDO2 by using it as a second factor in an MFA setup. In this configuration, FIDO2-enabled authenticators work alongside existing credentials, such as usernames and passwords. This allows organizations to immediately improve security without overhauling their systems.

For example, users can first enter a password and then authenticate using a FIDO2-compatible device, such as a biometric sensor or hardware key. This transitional strategy is particularly useful in industries with legacy systems that are not yet compatible with fully passwordless workflows. Passkeys, sometimes referred to as client-side discoverable credentials or previously resident keys, are stored securely on the user’s authenticator, allowing for direct access without needing external references like usernames or passwords. This functionality simplifies login processes, particularly for passwordless systems, by enabling users to authenticate using only their devices.

Organizations should encourage or mandate the use of passkeys wherever possible, as they improve both security and user experience. For example, passkeys are beneficial in scenarios where users frequently switch devices, such as in bring-your-own-device (BYOD) workplaces or for customer-facing applications. By minimizing dependencies on remote credential storage, they reduce vulnerabilities from server breaches or synchronization errors.

Attestation allows services to verify the authenticity and trustworthiness of user devices by validating the hardware or software origin of the authenticator. While this improves security by ensuring only trusted devices are registered, overly strict attestation requirements can inadvertently limit user adoption by excluding older or unsupported devices. Organizations should define attestation policies that balance security and usability, ensuring that only devices meeting specified criteria are trusted without alienating legitimate users. For example, in high-security environments, such as financial services or healthcare, enforce stringent attestation requirements to prevent the registration of unapproved devices. For general consumer applications, lenient or optional attestation policies might suffice.

One of FIDO2’s most significant advantages is its inherent resistance to phishing, and organizations should take full advantage of this feature during implementation. By enforcing origin-specific bindings, FIDO2 ensures that credentials are tied to the domain of the service, making it impossible for attackers to reuse credentials on fraudulent sites. This configuration requires careful attention to domain management, ensuring that all subdomains and related services are properly covered. To improve phishing resistance further, organizations can educate users on recognizing legitimate authentication prompts and reinforce secure behaviors. For example, services can implement clear and consistent UI elements during authentication to reduce confusion and prevent users from interacting with fake prompts.

Monitoring tools that detect and block phishing attempts targeting user accounts can also complement WebAuthn, providing an additional safety net. Regular updates to WebAuthn configurations, based on emerging phishing techniques and vulnerabilities, are also critical. Adopting FIDO2 can significantly boost security and reduce password fatigue, but many teams hit a wall when it comes to implementation. Frontegg changes that. With built-in support for FIDO2 and WebAuthn, Frontegg makes it easy to roll out passwordless authentication across your app without months of custom dev work.

Security teams can enforce stronger policies without relying on engineering sprints. Developers integrate once and stay out of the day-to-day. And your users get a login experience that’s fast, secure, and phishing resistant. 5. Performance Evaluation & Extended Technical Observations Frontegg takes care of the cryptographic heavy lifting, fallback flows, and cross-platform compatibility, so you can focus on delivering value, not debugging auth logic.

The latest versions of the FIDO Alliance user authentication specifications are available below. If you are new to FIDO, we recommend you first review the Authentication Specifications overview before proceeding further. In addition to meeting the technical requirements, the FIDO Alliance developed further security requirements that need to be implemented to enhance the security assurance of each device. These requirements are covered in the Authenticator Certification program found on the Certified Authenticator Levels page.

Older versions of the specifications can be found in the specification archive along with the Chinese translation of the UAF 1.0 specifications . The FIDO Specification Status and Intellectual Property Rights (IPR) of the FIDO Alliance specifications can be found here . The FIDO Alliances publishes the following technical specifications for any implementer to download. In addition, the Alliance is providing support for implementers of FIDO authentication technology by operating the fido-dev@fidoalliance.org public discussion list. Please post any questions you may have about implementing the FIDO specifications in that forum.

The FIDO Alliance produces PDF-formatted specifications as a convenience for readers, however readers are advised to refer to the HTML-formatted specs if they encounter any formatting issues with the PDF-formatted specs. IF YOU ARE NOT YET A MEMBER OF THE FIDO ALLIANCE, AND YOU WOULD LIKE TO COMMENT ON OUR PUBLIC DRAFT SPECIFICATIONS, PLEASE USE THE CONTACT US FORM.

2.3.1 Working Draft: HTML | PDF 2.3 Proposed Standard: HTML | PDF 2.2 Proposed Standard: HTML | PDF 2.1 Proposed Standard: HTML | PDF 2.1 Errata: HTML | PDF 2.3 Proposed Standard: HTML | PDF 2.2 Proposed Standard: HTML | PDF 2.1 Proposed Standard: HTML | PDF 2.1 Errata: HTML | PDF 2.2 Proposed Standard: HTML | PDF 2.1 Proposed Standard: HTML | PDF 2.1 Errata: HTML | PDF 3.1.1 Proposed Standard: HTML | PDF 3.1 Proposed Standard: HTML | PDF 3.0 Proposed Standard: HTML | PDF 3.1.1 Proposed Standard: HTML | PDF 3.1 Proposed Standard: HTML | PDF 3.0 Proposed Standard: HTML | PDF Explanation of IPR Status FIDO Alliance specifications progress through various stages, Pre-Draft, Working Draft, Review Draft and Proposed Standard. The Promise, the agreement FIDO Alliance Member organizations make to grant a royalty-free license of their patent rights for compliant implementations, is applied differently based on the specification stage. The Promise does not apply for Pre-Draft, Working Draft and Review Draft specification stages. At Proposed Standard stage, the Promise is provided by all FIDO Alliance members of the relevant Technical Working Group to the entire world. For any FIDO Alliance specifications issued as Proposed Standard before January 1, 2020, the Promise is a covenant not to assert patent rights against compliant implementations and is provided by all the then FIDO Alliance members to the entire world. It is understood that the above is a brief summary and that the actual terms are provided in the FIDO Alliance Membership Agreement , which should be consulted for any specific case.

Patent Notices The FIDO Alliance Membership Agreement provides Members the opportunity to make withdrawals of Granted Claims from the Promise under certain conditions. The FIDO Alliance Membership Agreement should be consulted for the specific conditions. The Board is pleased to report to the public that it has received no such notice pertaining to any of the Specifications published on this site. Implementers interested in learning more about what this means are encouraged to review our IPR Summary and/or section 6 of the FIDO Alliance Membership Agreement.

Receive the latest news, events, research and implementation guidance from the FIDO Alliance. Learn about digital identity and fast, phishing-resistant authentication with passkeys. Traditional authentication relies on a shared secret—a password—where the client proves knowledge of the string to the server. This model is vulnerable to phishing, credential stuffing, and database breaches. FIDO2 and WebAuthn replace the shared secret with an asymmetric key pair generated directly on the user's device. The private key remains locked inside the authenticator (a YubiKey, a smartphone, or a platform TPM), while the public key is registered with the server. Authentication becomes a challenge-response protocol: the server issues a nonce, the authenticator signs it with the private key, and the server verifies the signature using the stored public key. No secret ever traverses the network.

The core mechanism here is the binding of the credential to the relying party (your application). During registration, the authenticator generates a key pair specific to the rpId (Relying Party Identifier). If you change your domain or subdomain, the keys generated for the old domain become useless, preventing cross-site phishing attacks where a malicious site tries to trick a user into authenticating against the legitimate site's keys. This binding is the foundation of passwordless MFA, ensuring that credentials are intrinsically tied to the specific domain context.

This contrasts sharply with traditional password hashing. In the password model, the server stores a hash of the secret; if the database is breached, the attacker can attempt offline cracking or reuse the credentials elsewhere. In the FIDO2 model, the server stores only the public key and metadata. Even if an attacker steals the database containing the public keys and the user IDs, they cannot authenticate because they do not have the private key.

To implement this in a Spring Boot application, we need a library that can parse the complex JSON structures defined by the WebAuthn specification and integrate them into the Spring Security filter chain. The standard approach involves two primary components: a library for cryptographic verification and a Spring Security module to handle the authentication flow. We will use webauthn4j for the heavy lifting of parsing the JSON assertions and performing the cryptographic signature verification. This library handles the granular details of the WebAuthn protocol, such as validating the clientDataJSON hash and checking the authenticatorData flags. For the Spring integration, we use the spring-security-webauthn project (or manual configuration using webauthn4j beans) to create a custom AuthenticationProvider that the Spring Security context can use, effectively bridging the gap between raw cryptographic data and Spring Security's Authentication objects.

Let's trace the flow with a concrete scenario. Alice wants to register her YubiKey 5. Her browser calls your Spring Boot backend endpoint /api/auth/webauthn/register/start . Your backend must generate a set of options for the browser to pass to the authenticator. This is done by creating a CredentialCreationOptions object. The server needs a unique userId (not the username, but a random UUID to decouple identity from the credential) and the rpId .

The server returns these options as JSON to the browser. The browser then invokes navigator.credentials.create(options) . The YubiKey 5 receives the request. It prompts Alice to touch the device. The device generates a fresh ECDSA P-256 key pair. It signs the challenge using the private key and attaches the authenticatorData , which includes the RP ID hash and a flag indicating if the user was verified (via touch). The device returns a CredentialCreationResponse containing the public key and the attestation object to the browser, which POSTs it back to /api/auth/webauthn/register/finish .

On the server side, you receive this payload. You must verify the attestation. This is where webauthn4j becomes critical. You do not trust the JSON; you trust the cryptographic proof. The verification process checks three things mechanically during registration. First, it ensures the challenge in the response matches the one issued. Second, it verifies the signature of the attestation object against the root certificates (if self-signed, it verifies the chain). Third, and most importantly for security, it checks the authenticatorData . Specifically, it checks the User Verified (UV) flag and the User Present (UP) flag. If UV is false, the device didn't confirm the user's presence (e.g., via fingerprint or PIN), which violates the requirement for high-assurance authentication.

During login, the verification mechanism shifts focus. The server no longer checks attestation against root certificates. Instead, it retrieves the user's previously stored public key and uses it to verify the assertion signature generated by the authenticator. This ensures the user possesses the private key corresponding to the registered credential without needing to re-verify the hardware's root of trust.

Once registered, Alice attempts to log in. She visits /login and the server calls /api/auth/webauthn/login/start . The server retrieves Alice's stored public key and userId from the database. It generates a new challenge and sends CredentialRequestOptions to the browser. The browser asks the YubiKey to sign this new challenge. The YubiKey uses the private key corresponding to the stored public key. It returns the signature and the credentialId . The browser posts this to /api/auth/webauthn/login/finish .

The server retrieves the public key associated with that credentialId . It constructs a WebAuthnAssertionResponse using the options, the request JSON, and the retrieved public key. The verification step here is purely cryptographic. If the signature matches the public key and the challenge is valid, the server knows the user possesses the private key. At this point, Spring Security creates an Authentication object. We typically map the userId to a UserDetails implementation.

Implementing this in Spring Boot requires careful dependency management. You must ensure that the version of webauthn4j is compatible with the Java version you are running, as the cryptographic libraries have evolved. Additionally, you need to handle the UserVerificationRequirement strictly. In a production environment, you should enforce REQUIRED for the user verification method (biometric or PIN) rather than DISCOURAGED or PREFERRED . This ensures that a simple tap is not enough; the user must actively prove they are the owner of the device.

There is a critical nuance in the authenticatorData that developers often miss. The authenticatorData contains the RP ID Hash . The authenticator only signs data if the RP ID matches the one configured on the device. If you host your app at app.example.com but the rpId is set to example.com , the authenticator will reject the request because the computed RP ID hashes will not match. Strictly speaking, the hash must match the domain you are operating on to prevent subdomain hijacking.

One common point of failure is the handling of the counter . FIDO2 authenticators maintain a counter for each credential. If the counter in the response is less than or equal to the counter stored in the database, it indicates a replay attack or a cloned authenticator. The server must reject the login immediately if responseCounter <= storedCounter . This prevents an attacker from capturing a valid login response and replaying it later.

Harvested Online Documentation & Reference Sources • https://en.wikipedia.org/wiki/Passwordless%20authentication • https://en.wikipedia.org/wiki/WebAuthn • https://en.wikipedia.org/wiki/Passkey%20%28credential%29 • https://fidoalliance.org/specifications/ • https://ashishsrivastav.com/blog/passwordless-authentication-implementation-guide • https://martinuke0.github.io/posts/2026-09-18-implementing-webauthn-for-passwordless-authentication-a-practical-guide/ • https://startwithidentity.com/guides/authentication/passwordless-authentication-implementation-guide/ • https://frontegg.com/guides/passwordless-authentication-with-fido2-and-webauthn • https://fidoalliance.org/specifications/download/ • https://ashishsrivastav.com/blog/implementing-passwordless-mfa-fido2-webauthn-spring-boot