FIDO2

FIDO2 and passkeys offer phishing-resistant, passwordless authentication and MFA via a key pair cryptographically bound to the real website.

FIDO2 (the W3C WebAuthn standard plus the FIDO Alliance's CTAP, short for Client to Authenticator Protocol) is the open standard for phishing-resistant, passwordless authentication: a key pair on the user's device or security key signs a challenge that is cryptographically bound to the genuine website. There is no password or code that a phishing site can capture, and biometrics stay local on the device.

Passkeys are the consumer packaging of FIDO2 credentials. Synced passkeys are copied across a user's devices via a platform account, while device-bound passkeys remain tied to a single device or security key - a distinction that affects recovery options and the achievable eIDAS assurance level, since synced passkeys generally cap out below the highest levels and a FIDO2 authenticator is not itself a QSCD - one piece of hardware can carry both a FIDO2 authenticator and a separately certified QSCD applet, but the FIDO2 side is not what the certification covers. In the identity world FIDO2 plays a role as a strong possession factor - for logging in, and potentially within wallet and remote signing authorisation flows.