WebAuthn

What it means

WebAuthn, short for Web Authentication, is a W3C standard that lets a website ask the browser to create and use a cryptographic key pair. The browser talks to an authenticator, such as a phone, a laptop chip or a hardware security key, and returns a signed result.

Your server never sees the private key. It stores a public key at registration, then sends a random challenge at each sign-in and checks that the signature on it is valid and made for your website address. That pairing of challenge and domain is what makes a captured response useless anywhere else.

Why it matters

Because the credential is tied to your site's domain, a lookalike page cannot collect a response that works on the real one. That is why it resists phishing in a way that one-time codes and passwords do not. A copied sign-in message is worth nothing on another site.

The standard does the cryptography well, but it is up to your server to do its half. A server that skips the challenge check, the origin check or the signature check turns a strong design into a login that anyone can satisfy with a forged response.

How it shows up

You meet it as two browser calls, navigator.credentials.create() to register and navigator.credentials.get() to sign in, plus server code that handles the results. It only works in a secure context, meaning over HTTPS. It underpins passkeys and security keys used as a second factor.

Check that each challenge is random, single use and tied to the session that asked for it. Check that the server verifies the origin and the relying party identifier, and that the credential belongs to the account being signed in. A library handles most of this, and the usual mistake is stopping halfway through its checks.