--- title: "FIDO2 — Identity Glossary | IDSync" description: "FIDO2 is the open authentication standard that lets users sign in to websites and apps using public-key cryptography — implemented by WebAuthn in browsers…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "FIDO2", "item": "https://idsync.com/glossary/fido2" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/fido2", "name": "FIDO2", "alternateName": [ "FIDO2", "WebAuthn", "CTAP2" ], "description": "FIDO2 is the open authentication standard that lets users sign in to websites and apps using public-key cryptography — implemented by WebAuthn in browsers and CTAP2 between the browser and the authenticator (security key, phone, or platform TPM).", "url": "https://idsync.com/glossary/fido2", "inDefinedTermSet": "https://idsync.com/glossary" } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. FIDO2 Authentication # FIDO2 FIDO2 is the open authentication standard that lets users sign in to websites and apps using public-key cryptography — implemented by WebAuthn in browsers and CTAP2 between the browser and the authenticator (security key, phone, or platform TPM). Last reviewed 3 months ago Key points - FIDO2 = WebAuthn (W3C, browser ↔ server) + CTAP2 (FIDO Alliance, browser ↔ authenticator). - It is phishing-resistant: the credential is cryptographically bound to the origin (rp\_id), so a fake site can't replay it. - Authenticators can be roaming (YubiKey, Titan) or platform (Touch ID, Windows Hello, Android biometrics). - Passkeys are the consumer-friendly UX layer on top of FIDO2/WebAuthn — typically discoverable, synced credentials. - Enterprise FIDO2 is the gold standard for MFA: it defeats phishing, SIM swap, push-bombing, and adversary-in-the-middle attacks. ## What is FIDO2? FIDO2 is the umbrella name for the open authentication standards that enable phishing-resistant, public-key sign-in across the web and native apps. It has two halves: - **WebAuthn** — a W3C standard exposed as a JavaScript API in every modern browser. It defines how a relying party (website) and the user's browser exchange cryptographic challenges. - **CTAP2 (Client-to-Authenticator Protocol)** — defines how the browser talks to the actual authenticator (a USB security key, NFC token, phone, or built-in platform authenticator like Touch ID or Windows Hello). Together they replace passwords with a key pair: the private key never leaves the authenticator, and the public key is what the server stores. ## How it works 1. **Registration** — the server sends a challenge plus its origin (rp\_id). The authenticator generates a new key pair, signs the challenge, and returns the public key. The server stores it against the user. 2. **Authentication** — the server sends a new challenge. The authenticator signs it with the private key (after a user gesture: biometric, PIN, or button press). The server verifies the signature using the stored public key. The critical property: the browser binds the credential to the **origin**. A phishing site at `aceme.com` cannot get a signature for `acme.com`, because the browser refuses to talk to the wrong rp\_id. This is what makes FIDO2 phishing-resistant — and why it's the only MFA factor CISA recommends for high-value accounts. ## When buyers care - **Phishing-resistant MFA** mandates (CISA BOD, US Executive Order 14028, PCI DSS 4.0, NYDFS 500.12). - **Eliminating push bombing** — Microsoft, Cisco, and others recommend moving from push MFA to FIDO2 after the Uber, Twilio, and Cisco breaches. - **Passwordless rollouts** — passkeys (the synced flavor of FIDO2) are the consumer UX; security keys are the enterprise high-assurance option. - **Privileged users** — admins, finance, executives should be FIDO2-only. ## FIDO2 vs Passkeys vs Security Keys - **FIDO2** is the underlying standard. - **Security keys** (YubiKey, Titan, Feitian) are roaming authenticators — usually device-bound, non-syncable, highest assurance. - **Passkeys** are FIDO2 credentials that are either device-bound (Windows Hello) or synced across a user's devices via iCloud Keychain / Google Password Manager / 1Password / Dashlane. ## Editorial note If a vendor sells "passwordless" without FIDO2 under the hood (e.g. magic links or push notifications), it is not phishing-resistant — it's just password-less. ## Standards & references - [W3C WebAuthn Level 3](https://www.w3.org/TR/webauthn-3/) - [FIDO Alliance specs](https://fidoalliance.org/specifications/) IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [mfa](/directory/category/mfa)[passwordless](/directory/category/passwordless) ### Related terms [passkeys](/glossary/passkeys)[multi factor authentication](/glossary/multi-factor-authentication)[phishing resistant mfa](/glossary/phishing-resistant-mfa) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the mfa category. [Explore tools](/directory/category/mfa) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.