How Does WebAuthn Differ From Passkeys?

WebAuthn is a web security protocol developed by the FIDO Alliance, designed to enable secure, passwordless authentication on the web. Passkeys, on the other hand, are a specific implementation of WebAuthn that focuses on providing a user-friendly, secure authentication method by replacing traditional passwords with cryptographic keys stored on a user’s device.

• WebAuthn is the broader protocol; passkeys are a specific application of that protocol.
• WebAuthn can support multiple authentication methods, including hardware security keys; passkeys
• Passkeys aim to enhance user experience by simplifying the authentication process, while WebAuthn provides the underlying framework for various passwordless solutions.

---

WebAuthn (Web Authentication) is a web standard published by the W3C and supported by major browsers. It enables strong, phishing-resistant authentication by allowing users to sign in with a cryptographic key pair, rather than a password. WebAuthn was developed by the FIDO Alliance (Fast Identity Online) and is a key component of their broader FIDO2 project, which aims to reduce the reliance on passwords.

Passkeys are a technology based on the WebAuthn standard, designed to further simplify the user experience while maintaining high security. Passkeys work by generating and storing a unique cryptographic key pair on a user’s device - typically in hardware security module like the Trusted Platform Module (TPM) or Secure Enclave. When a user attempts to sign in, the website or service sends a challenge, which is signed by the private key stored on the user’s device. This signed challenge is then sent back and verified by the service using the public key.

• WebAuthn's flexibility: WebAuthn supports multiple types of authenticators, including external hardware security keys (like YubiKeys), biometric devices, and passkeys stored on a user’s device.
• Passkeys for convenience: Passkeys are specifically designed to replace traditional passwords and provide a seamless authentication experience. They can be used with a user’s device, meaning users don't need to remember a password or carry an external hardware security keys.
• Adoption: While WebAuthn is a versatile protocol used by various industries, passkeys are increasingly being adopted for consumer-facing applications where ease of use is crucial.

---