Security Lingo Explained: WebAuthn (Passkeys and Passwordless Authentication)

The security space can be a strange and confusing place for newcomers, and passwordless authentication is a perfect example of a term that sounds simple but rarely is. In this series of posts, we aim to shed light on the security lingo you may encounter when reading the latest security specifications and scanning your favorite Duende documentation.

By the end of this post, you'll have added one more security phrase to your growing lexicon of security jargon with which to impress your fellow security professionals.

Today's security lingo is WebAuthn, so let's discuss what the term stands for and where you can see and hear it used.

What is WebAuthn?

WebAuthn, short for Web Authentication, is a W3C standard and a core component of the FIDO2 framework. It powers passwordless authentication by defining a browser API that lets websites authenticate users through public-key cryptography instead of passwords, using authenticators like fingerprint sensors, facial recognition, hardware security keys, or your phone's lock screen.

With WebAuthn, your private key never is never sent to the server. When you register with a website, your authenticator creates a key pair. The public key goes to the server, the private key stays locked inside your hardware. When you log in, the server sends a challenge, your authenticator signs it with the private key, and the server verifies the signature with the public key it stored earlier. The server never sees your private key, and there's no malicious actor who can steal your shared secret from a third-party database.

This is what's behind those "Sign in with your fingerprint" or "Use your passkey" prompts you've been seeing more of lately. Passkeys (the consumer-friendly face of WebAuthn) sync across your devices via your platform vendor (Apple, Google, Microsoft), so you get phishing-resistant authentication without carrying a hardware key everywhere you go. Though if you do carry a YubiKey on your keychain and have a backup key in a drawer at home, we respect that energy.

From a phishing perspective, WebAuthn changes the game. The credential is bound to the origin (the website's domain), so even if an attacker builds a pixel-perfect fake login page, your authenticator won't respond. It doesn't know that domain.

WebAuthn and passwordless authentication

WebAuthn is often discussed under the broader banner of passwordless authentication, the movement to verify users without a shared secret they have to remember. Not all passwordless methods are equal. SMS one-time passwords, authenticator app codes (TOTP), and email magic links all remove the password, but they still rely on codes that can be phished, intercepted, or lost to SIM-swapping. WebAuthn sits at the top of that spectrum: because the credential is bound to your device and the site's origin, there's no code to steal and nothing to type. When people talk about "true" passwordless authentication, WebAuthn and passkeys are what they mean.

For teams building identity solutions with Duende IdentityServer, Duende User Management provides production-ready passkey support and handles the WebAuthn ceremonies, credential storage, and signature verification. You can wire passkeys into your IdentityServer login pages alongside, or eventually instead of, traditional password flows. For a deeper look, check out our post on passkeys and WebAuthn with Duende IdentityServer.

So next time someone says "WebAuthn," you'll know it's the technology behind modern passwordless authentication, slowly making passwords obsolete.

We hope you found this post enlightening. If there's other security lingo you're unsure about, please let us know in the comments, and we'll be happy to explain. And while you're here, please take a moment to explore our range of security products and join our community in our public discussions.