10:21in productionCh. 1 · What it is/ 10:21 · ceiling 15 min
Security · Web & cloud
WebAuthn
WebAuthn doesn’t kill passwords—it just makes them optional for those who can afford the stack.
WebAuthn is a specification—not a service, not a vendor, not a magic bullet. It standardises how websites talk to cryptographic authenticators. Its strength is narrow: domain binding, signature verification, and U2F continuity. Its limits are structural: no recovery path, no cross-device sync spec, no enforcement of UX or privacy guarantees. It matters because it changes what ‘login’ means—not because it ends passwords.
WebAuthn is a W3C standard defining both a browser API and authenticator behaviour—not a product or protocol extension.
3:02
How it solves passwords
It replaces password verification with digital signature verification—shifting trust from secrecy to cryptography.
4:38
What actually resists phishing
Backward compatibility with U2F and domain-bound credentials make phishing resistance practical—not theoretical.
6:35
Three levels, not one revolution
Level 1 launched in 2019, Level 2 in 2021, and Level 3 was proposed for Recommendation in July 2026—evolution is incremental, not disruptive.
Worth your time?
Yes. Study the whole thing.
4/ 5
What works
domain-bound credential binding
digital signature verification instead of passwords
backward compatibility with U2F via CTAP
cross-platform browser integration
What does not
eliminate phishing
standardise backup or recovery
enforce consistent UX
define credential syncing
Study it if
web developers building auth flows
platform teams managing identity infrastructure
security engineers evaluating phishing resistance
Skip it if
teams supporting IE11 or Android 4.x
organisations without device management policies
products requiring anonymous or passwordless fallback
The written brief1 min read
What it is and the problem it solves
WebAuthn is a W3C-published web standard that replaces password-based login with cryptographic credentials. It solves the core weaknesses of passwords: reuse, theft, and phishing susceptibility.
How it works
WebAuthn defines a browser API for websites to authenticate users using cryptographic credentials. It specifies how authenticators—like security keys or platform biometric sensors—must behave. It uses digital signature verification instead of passwords. It binds each credential to a specific website domain.
What works
It resists some phishing attacks by restricting credential use to the registered website. It is backward compatible with U2F via CTAP. It works across modern browsers and operating systems that implement the standard. It enables passkey-based login without passwords.
What does not
WebAuthn does not eliminate phishing entirely. It does not solve account recovery. It does not standardise user experience across platforms. It does not mandate biometric use—it only allows it. It does not define how credentials are stored, backed up, or synced across devices.
What it changes
It shifts authentication from shared secrets (passwords) to cryptographic key pairs held in trusted authenticators. It moves credential management out of the browser’s password manager and into the OS or hardware. It makes phishing resistance a baseline expectation—not an add-on.
Is it worth your time
Yes—if you build or operate web services that require strong, phishing-resistant authentication and can commit to supporting modern browsers and authenticators. No—if you need broad legacy browser support or must accommodate users without compatible hardware or OS-level authenticators.