WebAuthn

WebAuthn is a shared rule for how a person logs in to a website without typing a password. Instead of a word you have to remember, you use your own device as proof: a phone, a laptop, or a small USB stick made specifically for this purpose. You unlock the device as usual, say with a fingerprint, your face, or a short device PIN. The device then confirms to the website that the rightful owner is sitting in front of it. The fingerprint itself never leaves the device. The rule was developed by two organizations that set standards for the internet: the W3C and the FIDO Alliance.

Why passwords are the weakest link

A password has a built-in design flaw: it is a secret that you have to hand over in order to use it. Every time you log in, you send it to a server. It gets stored there, usually encrypted, but stored nonetheless. If that server gets hacked, millions of credentials disappear at once. This happens regularly, and the stolen lists are then resold online.

On top of that there is phishing. A fake login page can look deceptively similar to the real one, and anyone who types their password there has handed it straight to the attacker. Even the extra code sent by SMS only helps to a limited degree, since it too can be requested on a fake page. WebAuthn closes this gap through technical means. The browser remembers which internet address a given login belongs to, and refuses to log in at a different address. A human can be fooled, but this check cannot.

For companies, this is also a matter of cost. A large share of all requests to IT help desks consist of forgotten passwords. If the password disappears, so, largely, do these requests.

The key pair behind the login

During initial setup, the device generates two matching strings of numbers, known as a key pair. One half, the public key, goes to the website and can safely be known publicly. The other half, the private key, stays on the device forever. A good analogy: the public key is a padlock that can be handed out freely. Only the private key in the device fits it.

When logging in, the website sends a random sequence of numbers, a kind of puzzle. The device signs this sequence with the private key and sends the signature back. The website then checks with the public key whether the signature matches. Because the puzzle is different every time, an intercepted answer is useless to an attacker. A password that has been cracked once, by contrast, works an unlimited number of times.

The fingerprint plays a different role in this process than many people assume. It is not sent to the website and compared there. It merely unlocks the private key locally on the device. A common misconception is therefore that WebAuthn is a facial-recognition method used over the internet. In fact, the biometric data is only the key to unlocking the actual key.

Passkeys in everyday life

Most often, people encounter WebAuthn under the name passkey. A passkey is nothing other than a WebAuthn login that is additionally synced across your own devices via the cloud. Google, Apple, and Microsoft have offered this for a few years now. Anyone who has ever logged in to Google, PayPal, Amazon, or GitHub using just their phone has used WebAuthn.

There is also a hardware variant: a small stick that you plug into a USB port or hold up to your phone. Such sticks cost roughly 25 to 60 euros and are common in government agencies, banks, and large companies. The advantage is a clear separation from the computer; the disadvantage is that you can lose them. For this reason, it is standard practice to set up at least two logins.

In the news, the term often appears alongside the word passwordless. Experts do not expect passwords to disappear completely anytime soon. Many older systems cannot be retrofitted, and a second way back into an account is needed for emergencies. A realistic outlook is a long transition period in which both approaches coexist.