WebAuthn

WebAuthn (Web Authentication) is a W3C standard that lets web applications authenticate users using public-key cryptography instead of passwords, and is the technical basis of passkeys.

WebAuthn is a standard published by the W3C (in collaboration with the FIDO Alliance) that defines an API for browsers and web applications to authenticate users using public-key cryptography. Instead of a shared secret like a password, the user's device generates a key pair: the private key never leaves the device (often protected by a secure chip or local biometrics), and the public key is registered with the server.

During authentication, the server sends a challenge that the device signs with the private key; the server verifies the signature with the public key. Since no shared secret is transmitted, WebAuthn is resistant to phishing (a fake site can't reuse the signature) and to password database breaches.

Passkeys are, in practice, the end-user-facing form of WebAuthn: a WebAuthn credential that can sync across devices via a password manager or the operating system.

As of today, V4ult does not offer sign-in via WebAuthn or passkeys; its biometric authentication (Face ID, Touch ID, Android biometrics) locally unlocks a session already started with the master password — it does not replace registering a WebAuthn credential with the server.

Advantages

• Resistant to phishing: there's no shared secret to steal
• The private key never leaves the user's device
• Removes the risk of reusing leaked passwords

Related

Frequently asked questions