FIDO2

FIDO2 and passkeys offer phishing-resistant, passwordless authentication and MFA via a key pair cryptographically bound to the real website.

FIDO2 (the W3C WebAuthn standard plus the FIDO Alliance's CTAP, short for Client to Authenticator Protocol) is the open standard for phishing-resistant, passwordless authentication: a key pair on the user's device or security key signs a challenge that is cryptographically bound to the genuine website. There is no password or code that a phishing site can capture, and biometrics stay local on the device.

Passkeys are the consumer packaging of FIDO2 credentials. Synced passkeys are copied across a user's devices via a platform account, while device-bound passkeys remain tied to a single device or security key - a distinction that affects recovery options and the achievable eIDAS assurance level, since synced passkeys generally cap out below the highest levels and FIDO2 authenticators are not QSCDs. In the identity world FIDO2 plays a role as a strong possession factor - for logging in, and potentially within wallet and remote signing authorisation flows.