Passkeys, FIDO2 and WebAuthn: how phishing-resistant sign-in works

What it is

FIDO2 is the umbrella name for two specifications: the W3C Web Authentication (WebAuthn) API, which websites call from JavaScript, and the FIDO Alliance Client to Authenticator Protocol (CTAP), which lets a browser talk to an authenticator such as a security key or a phone. A passkey is the user-friendly name for a FIDO2 discoverable credential: a key pair created for one website, unlocked locally with a fingerprint, face scan or device PIN.

Why it matters

Passwords can be guessed, reused, stolen in breaches and typed into fake sites. One-time codes by SMS or authenticator app improve things, but users can still be tricked into typing the code into a phishing page, which relays it in real time. FIDO2 is phishing-resistant because the authenticator only signs for the origin the browser actually connected to, and the server checks that origin. There is also no shared secret on the server to steal: a breached public key is useless to an attacker. For background on passwords and MFA, see strong passwords and MFA.

Key ideas

• Registration creates a new key pair scoped to a relying party ID (usually the domain). The server stores the public key and a credential ID.
• Authentication signs a fresh server challenge together with the origin and some flags, such as whether the user was verified.
• User verification happens on the device. The biometric never leaves it; the server only learns that verification succeeded.
• Synced versus device-bound. Synced passkeys are backed up and shared across a user’s devices by a credential manager, which solves the "lost phone" problem. Device-bound credentials, typically on hardware security keys, never leave one device and suit high-assurance use.
• Attestation optionally lets the authenticator prove its make and model, which organisations can use to allow only approved hardware.
• Cross-device sign-in lets you use a phone’s passkey to sign in on a nearby computer, using a QR code and a Bluetooth proximity check.

What changed recently

• NIST SP 800-63-4, the US digital identity guidelines, was finalised in July 2025. It integrates syncable authenticators such as synced passkeys, which earlier guidance did not clearly allow, and places strong emphasis on phishing-resistant authentication.
• WebAuthn Level 3 became a W3C Recommendation on 25 August 2026. It brings features developed over several years, such as related origin requests, which let one passkey work across a small set of an organisation’s related domains, along with better signals between sites and credential managers. Further features will go into Level 4.
• Portability. The FIDO Alliance has been developing specifications for securely moving passkeys between credential managers, addressing fears of lock-in to one platform.

How practitioners apply it

1. Start with administrators and high-risk users. Require hardware security keys or device-bound passkeys for privileged accounts, cloud consoles and network device management.
2. Offer passkeys to all users as an option alongside existing methods, then make them the default.
3. Harden recovery. Account recovery is the new weak point. If a phishable fallback such as SMS remains, attackers will target it.
4. Use your identity provider’s policies to require phishing-resistant methods for sensitive applications, which supports zero trust designs.
5. Test with libraries rather than writing WebAuthn verification yourself; signature, origin and counter checks are easy to get subtly wrong.

A common rollout pattern in organisations runs in three stages. First, the identity provider is configured to accept FIDO2 credentials and IT staff enrol hardware keys. Second, all users are invited to add a passkey, with clear guidance and help-desk support, while existing methods remain. Third, conditional access policies require a phishing-resistant method for sensitive apps, and weaker methods such as SMS are removed for most users. Tracking the share of sign-ins that use phishing-resistant methods gives a simple, meaningful progress metric for leadership.

Tip: In a lab, register a security key with a test web application, then try signing in from a page on a different domain. The browser will refuse, which is a vivid demonstration of origin binding.

Limitations and open questions

• Synced passkeys move trust to the credential manager account. If that account is compromised, so are its passkeys. Its own protection matters.
• Shared and kiosk devices, and users without smartphones, still need alternatives.
• Session theft remains. Passkeys protect sign-in, not the session cookie afterwards. Malware that steals cookies bypasses them, so token binding and short sessions still matter.
• User understanding is still developing; inconsistent wording across platforms confuses people.