Short answer: FIDO2 is the overall standard for logging in with cryptography instead of shared secrets. It has two halves: WebAuthn, the browser API that websites call, and CTAP, the protocol your browser uses to talk to an external authenticator such as a security key. Passkeys and security keys are the two things you actually touch — both are FIDO2 credentials, used through WebAuthn.
The problem it was built to solve
Every traditional login shares a secret. You know a password, the server stores a hash of it. You hold a TOTP seed, the server holds the same seed. Shared secrets can be stolen from either end, and — more importantly — you can be persuaded to hand yours to the wrong party.
FIDO2 removes the shared secret entirely. When you register, your device generates a key pair. The private key never leaves the device. The site stores only the public key, which is useless to anyone who steals it.
Logging in becomes a challenge and a signature: the site sends random data, your device signs it, the site verifies with the public key. There is nothing to phish, nothing to replay, and nothing worth stealing from the site’s database.
The three names, sorted out
- FIDO2 — the umbrella standard from the FIDO Alliance. It comprises WebAuthn plus CTAP.
- WebAuthn — a W3C web standard. The JavaScript API a website calls to say “create a credential” or “verify this user”. Supported by every major browser.
- CTAP (Client to Authenticator Protocol) — how the browser communicates with an external authenticator over USB, NFC or Bluetooth. Only relevant when the authenticator is a separate device.
Roughly: FIDO2 is the system, WebAuthn is the website’s side of it, CTAP is the cable.
You will also meet U2F — the earlier generation, now called CTAP1. It provided second-factor security keys but could not replace passwords. Most modern keys support both.
Platform vs roaming authenticators
An authenticator is whatever holds the private key. Two kinds:
- Platform authenticators — built into the device. Face ID and the Secure Enclave on iPhone, Windows Hello and the TPM, Android’s hardware keystore. This is what a passkey usually lives in.
- Roaming authenticators — separate hardware you carry. A YubiKey, Titan key, or Nitrokey, connected by USB, NFC or Bluetooth. See what a hardware security key is.
Both use identical cryptography. The difference is where the key lives and whether it can move between devices — the core of YubiKey vs passkeys.
Why it cannot be phished
This is the property that matters, and it comes from one design decision: credentials are bound to an origin.
When you register a credential on google.com, the browser records that origin as part of the credential. Later, on a phishing page at google-secure-login.com, the browser looks for a credential matching that origin, finds none, and the login simply cannot proceed. There is no prompt to misread, no warning to dismiss, no judgement call for a tired human at 11pm.
Compare that with a six-digit code. A convincing fake page asks for it, you supply it, and it is relayed to the real site within seconds. The code is valid — it was just given to the wrong party. Our post on how 2FA gets bypassed covers that attack, and what phishing-resistant MFA is covers the category.
Where passkeys fit
A passkey is a FIDO2 credential that is discoverable — the device can find it without you first typing a username. That is why passkey sign-in feels like one tap rather than a second step.
Passkeys typically sync through iCloud Keychain, Google Password Manager or a password manager, so they survive a lost phone. Security keys deliberately do not sync, which makes them harder to compromise and easier to lose permanently.
Both are FIDO2 through WebAuthn. “Passkey” is simply the consumer-friendly name for the synced, discoverable variety. Our comparison of passkeys vs 2FA covers when to switch.
Is it one factor or two?
A common confusion. A FIDO2 login combines:
- Something you have — the device or key holding the private key.
- Something you know or are — the PIN or biometric that unlocks it.
So a single passkey tap is genuinely multi-factor, even though it looks like one step. This is why sites increasingly accept a passkey instead of a password rather than in addition to one. See MFA vs 2FA for the terminology.
What it does not fix
Worth being clear about the limits:
- Session theft. Malware that steals an authenticated browser cookie bypasses login entirely. No authentication method helps once you are already in.
- Weak account recovery. If losing your key means answering security questions or a support call, your real security is that fallback.
- Leftover weak methods. Registering a security key while leaving SMS enabled achieves little — the attacker takes the easier route. Your account is only as strong as the weakest method left switched on.
- Coverage. Many banks, exchanges and smaller services still offer only codes. Until they change, an authenticator app remains your strongest option there — see how TOTP codes work.
Frequently asked questions
Do I need to understand WebAuthn to use passkeys?
No. It runs invisibly. The practical knowledge is: create passkeys where offered, keep a backup method, and understand that a passkey lives on your device or in your password manager.
Is WebAuthn the same as a passkey?
No. WebAuthn is the API; a passkey is a credential created through it. Roughly like the difference between the postal system and a letter.
Which browsers and devices support it?
All current major browsers and operating systems — Chrome, Safari, Firefox, Edge, on Windows, macOS, iOS, Android and Linux. Support is essentially universal now; site adoption is the remaining gap.
What happens if I lose my security key?
You use another registered method, which is why the standard advice is to register two keys or keep a passkey as a fallback. See recovering accounts after losing a device.
Can my fingerprint be stolen from a site using WebAuthn?
No. Biometric data never leaves your device and is never transmitted. It only unlocks the local private key. The site receives a signature, nothing more.
Should I stop using my authenticator app?
No. Use FIDO2 where offered — starting with your email — and keep the app for everything else. Most of your accounts still have no other option. Comparison of apps: Aegis vs 2FAS.
The bottom line
FIDO2 is the standard, WebAuthn is how websites use it, and passkeys and security keys are what you hold. The single property that makes it different from everything before it is origin binding: the browser checks you are on the real site, using maths rather than your judgement. Turn it on where you can, keep an authenticator app for the rest, and remove weak fallbacks so the strong method is actually the one being used.
Still on codes for most accounts? Our free browser-based 2FA code generator handles TOTP locally.
2 Responses