Table of Contents
Don't have the time to read the entire post? Our human writers will be sad, but we understand. Summarize the post with your preferred LLM here instead.
FIDO2 is an open authentication standard from the FIDO Alliance and the W3C that replaces passwords with passkeys or security keys secured by public key cryptography. Instead of typing a password, users log in with a fingerprint, a face scan, a PIN, or a hardware key, and the standard works across most modern browsers, operating systems, and devices.
In 2023, 47% of online shoppers abandoned their cart because they forgot a password, and 60% gave up accessing an app altogether for the same reason. With passwords creating this much friction, and remaining a constant target for attackers, FIDO2 passwordless authentication has become the leading answer.
In this guide, we’ll break down what FIDO2 is, how does FIDO2 work, how it differs from FIDO, U2F, and UAF, and how it enables passwordless authentication across your apps.
At a glance
FIDO2 is an open authentication standard that lets users sign in with passkeys or security keys instead of passwords, using public key cryptography.
It is made up of two parts: the WebAuthn API, which the browser and app use, and the Client to Authenticator Protocol, or CTAP, which connects the device to an external authenticator.
Because the private key never leaves the user's device and no shared secret is sent to the server, FIDO2 login cannot be phished, guessed, or reused.
FIDO is the broader family of standards from the FIDO Alliance. FIDO2 is the current generation and replaces the earlier U2F and UAF standards.
FIDO2 works with both platform authenticators such as Face ID and Windows Hello, and roaming authenticators such as a YubiKey, so a hardware key is an option but not a requirement.
Quick facts
What FIDO2 is | An open standard for passwordless, public-key based authentication |
Who created it | The FIDO Alliance, in collaboration with the W3C |
What it replaces | Password-only logins, and the earlier U2F and UAF standards |
Its two components | WebAuthn and CTAP |
Key outcome | Phishing-resistant login with no shared secrets to steal |
What is FIDO2?
FIDO2 is an open authentication standard that enables users to log into desktop or mobile applications without using passwords.
FIDO2 was developed by the FIDO (Fast Identity Online) Alliance, an open industry consortium of tech companies formed in 2013 with the mission to develop and promote passwordless authentication standards and protocols.
Instead of passwords, FIDO authentication uses registered devices or FIDO2 security keys to validate user identities.
FIDO2 consists of two components:
The Web Authentication API (WebAuthn), which enables applications to authenticate users with possession-based and biometric authentication.
The Client to Authenticator Protocol (CTAP), which enables the client to communicate with a roaming authenticator, such as a hardware security key or a smartphone.
By combining these components, FIDO2 provides a more secure and user-friendly authentication experience, reducing the reliance on passwords that are often susceptible to various security threats like phishing and credential stuffing attacks. FIDO2 is supported by 95% of global user devices, making it a standard for modern, secure authentication.
What is a FIDO authenticator?
A FIDO authenticator is a software component or a piece of hardware possessed by the user that is capable of performing FIDO authentication. FIDO authenticators are used to verify possession and/or confirm user identity. They are also responsible for generating keypairs during user registration, protecting private key details, and signing digital certificates for attestation.
There are two types of FIDO authenticators: roaming authenticators and platform authenticators. Which one a user ends up relying on usually comes down to their device and the app’s configuration rather than a deliberate choice, since most operating systems default to whichever platform authenticator is already built in.
Roaming authenticator
A roaming authenticator is a device separate from the client device that can perform FIDO authentication. Roaming authenticators connect with client devices over USB, Near-field communication (NFC), or Bluetooth. These authenticators enable users to carry their credentials and use them to authenticate on multiple devices. For this reason, roaming authenticators are also referred to as cross-platform authenticators.
Examples: Tapping a USB security key, authenticating using a smartphone when logging in from a laptop
Platform authenticator
A platform authenticator is built into the user device that acts as the FIDO client. Common implementations of platform authenticators include some form of user biometric authentication backed by hardware chips (e.g. Trusted Platform Module, Trusted Execution Environment) that protect cryptographic keys. When a user authenticates using the same device they are logging in from, platform authenticators are at work.
Examples: Apple Touch ID, Apple Face ID, Windows Hello
How FIDO2 works
So, how does FIDO2 work in practice? The goal of FIDO authentication is to shift from “legacy, knowledge-based credentialing” to “modern, possession-based credentialing.” The standard relies on public-key cryptography to achieve this. By using a private-public keypair where the private key never leaves the user’s device, FIDO authentication removes the need for shared secrets between a client and a server.
The FIDO2 authentication flow breaks down into two parts: registering a new credential, and then using that credential to log in.
Here’s how FIDO registration works:
Step 1: During account registration, the user is prompted to choose a FIDO authentication mechanism supported by the application (also called the relying party).
Step 2: The user approves the FIDO authenticator by performing an action that depends on the authenticator. Common actions include touching a fingerprint reader, touching a security key, entering a PIN, or other approved authentication methods.
Step 3: A public-private keypair is created that is unique to the user’s device, the user’s account, and the application.
Step 4: The public key is sent to the application and associated with the user’s account. The private key never leaves the user’s device.
Here’s how login using FIDO works:
Step 1: During login, the application requires the user to log in with the FIDO authenticator used during registration.
Step 2: The user unlocks the authenticator using the same action that they performed during the registration process.
Step 3: The device looks up the private key based on the ID provided by the application. It signs the request and sends it back to the application.
Step 4: The application verifies the signed request with the stored public key. The user is logged in.
Looking for a way to test your WebAuthn flows? Check out Virtual WebAuthn, a set of Go tools that help developers test WebAuthn flows without needing a browser or an actual authenticator.
How FIDO2 enables passwordless authentication
FIDO2 is the technical foundation underneath most modern passkeys. When an app says it supports passkeys, it’s really relying on the FIDO2 standard (WebAuthn plus CTAP) to generate and verify the public-private keypair behind the scenes.
That’s how FIDO2 is used for passwordless authentication in practice: a user registers once with a platform or roaming authenticator, and from then on, every login is a FIDO2 challenge-response exchange instead of a password check. There’s no password to phish, reset, or leak in a breach, and the user experience collapses down to a fingerprint tap or a face scan. FIDO2 passwordless authentication has become the default recommendation for teams trying to cut both account takeover risk and login friction at the same time.
Many platform authenticators also sync FIDO2 credentials through the operating system’s own cloud account (iCloud Keychain, Google Password Manager, or Windows Hello), so a passkey created on one device is usable on another without repeating the whole registration step. Roaming authenticators like a USB security key don’t rely on this syncing at all, since the private key already lives on portable hardware the user can carry between devices. Either way, the app never has to store or manage anything resembling a password.
FIDO vs FIDO2: what is the difference?
FIDO isn’t a standard, it’s the alliance and the family of specifications it maintains. FIDO2 is simply the newest and broadest member of that family.
Standard | What it is | Status |
|---|---|---|
UAF | FIDO’s original passwordless standard, using on-device authentication | Superseded by FIDO2 |
U2F | FIDO’s original second-factor standard, paired with a password | Renamed CTAP1, still used inside FIDO2 |
FIDO2 | WebAuthn + CTAP, combining and extending UAF and U2F | Current standard |
So what is the difference between FIDO and FIDO2? FIDO is the umbrella organization and its broader mission; FIDO2 is the specific, current-generation standard that most passkey and security-key logins run on today. And whether you’re asking how does FIDO work or how does FIDO2 work, the underlying answer is the same: public-key cryptography, a device-bound private key, and no shared secret for a server to lose.
FIDO2 vs U2F vs UAF
FIDO2, U2F (Universal 2nd Factor), and UAF (Universal Authentication Framework) are all authentication standards developed by the FIDO Alliance, but they serve different purposes and have some key differences:
FIDO2 is the latest of these standards, combining the best features of U2F and UAF while expanding the scope to cover passwordless authentication end to end.
Let’s cover the basics of FIDO UAF and FIDO U2F to understand their differences.
Universal Authentication Framework (UAF)
FIDO Universal Authentication Framework (UAF) is an earlier version of FIDO’s open standards that provides passwordless authentication. FIDO UAF enables online applications to use native security features on end-user computing devices (like mobile devices and laptops) to perform strong authentication and reduce the reliance on passwords.
FIDO2 is broadly seen as the successor to FIDO UAF.
Universal Second Factor (U2F)
FIDO Universal Second Factor (U2F) is the first FIDO open standard, focused on providing two-factor authentication. FIDO U2F enables applications to supplement the security of their existing password infrastructure by adding a strong second factor of authentication. U2F defines how to establish communications between FIDO2-enabled browsers / operating systems and a FIDO U2F device (like a YubiKey) to implement multi-factor authentication.
After the release of FIDO2, U2F was renamed and is now known as CTAP1.
FIDO2 | U2F | UAF | |
|---|---|---|---|
Primary Focus | Full passwordless authentication | Strong second factor for 2FA | Passwordless authentication |
Authentication Methods | Biometrics, external security keys | External security keys | Biometrics, local authentication |
Platform Support | Widely supported across platforms, browsers, and devices | Initially focused on 2FA, now supported in various platforms | Varied support, may be limited compared to FIDO2 |
Biometric Data Handling | Stored and processed locally on user’s device | N/A | Stored and processed locally on user’s device |
Use Case | Full authentication solution for various scenarios | Strong second factor in two-factor authentication | Passwordless authentication, though less widely adopted |
Benefits of FIDO authentication
FIDO authentication provides a secure, private, convenient, and scalable way for users to access applications without using passwords.
Security
FIDO2 is more secure than traditional password-based authentication methods. Since FIDO authentication doesn’t use shared secrets like passwords, no sensitive user information is stored on application servers. This reduces the attack surface and makes applications less attractive targets for attackers.
Removing passwords also prevents bad behaviors like reusing passwords across online accounts and using boilerplate passwords. This in turn stops identity attacks like credential stuffing, phishing, and account takeover. The 2025 State of Customer Identity report from Descope found that 72% of organizations had already deployed passkeys or were planning to in the next two years, highlighting how organizations are beginning to follow through on the security promise of passkeys.
Convenience
FIDO2 provides a more user-friendly experience and simplified login process. With FIDO authentication, users don’t have to create and remember passwords, use password managers, or go through cumbersome password reset flows. Instead, users authenticate using built-in device capabilities like fingerprint readers or face scans, or by leveraging easy-to-use FIDO security keys.
FIDO authentication is also convenient for application builders. Developers no longer have to spend time on managing password infrastructure and can instead focus on building core application capabilities. IT teams save time on password-based help desk requests. Product teams prevent user friction and churn caused due to forgotten passwords.
User privacy
FIDO2 results in safer, decentralized storage of biometric data. The use of fingerprint or other biometric authentication methods often raises concerns about user privacy. However, privacy is one of the cornerstones of FIDO authentication. The biometric data used in FIDO authentication is securely stored on the user’s device and not transmitted to any external servers. Moreover, since FIDO key pairs are unique for each application, cybercriminals cannot use them to access other services.
Interoperability
FIDO2 is interoperable across various platforms, devices, and web browsers. It’s an open and license-free standard that is meant to be used as widely as possible while also maintaining high security. Any FIDO-certified service undergoes rigorous testing to ensure that clients, servers, and authenticators are all compatible.
Websites can enable FIDO2 with a JavaScript API call that is widely supported across major browsers and platforms, as well as billions of user devices.
FIDO2 implementation considerations
While FIDO2 authentication brings significant advantages, it’s important to consider some potential challenges associated with its implementation. None of these are dealbreakers on their own, but they do shape how quickly an organization can roll FIDO2 out and how much support users will need along the way:
Initial setup complexity: The initial setup process for FIDO2, involving the registration of devices and keys, can be more complex compared to traditional password setup. Users may need assistance or guidance during the setup phase. Organizations implementing FIDO authentication need to invest in user education and awareness programs to ensure smooth adoption and understanding.
Cost of hardware tokens: While some authentication methods within FIDO2 are cost-effective (such as biometrics), external hardware tokens can incur additional costs. This may be a consideration for organizations implementing FIDO2 at scale, especially for their employees and other non-customer stakeholders. This is also why FIDO2 doesn’t require a hardware security key: platform authenticators like Touch ID and Windows Hello let most users skip that cost entirely.
Limited support in legacy systems: Legacy systems and applications that rely on traditional password-based authentication may not readily support FIDO2. Migration to FIDO2 might require updates or modifications to existing systems, which can be a challenge for organizations with a large legacy infrastructure.
Drag & drop FIDO authentication with Descope
FIDO2 paves the way to a passwordless future, blending strong security with user convenience, but adding FIDO authentication to your app can be complex to build from scratch. Descope lets you add FIDO-certified biometric authentication with drag-and-drop workflows, SDKs, and APIs, and federates with your existing IdP so you can add passkeys to Auth0, Amazon Cognito, or Firebase without ripping out what you already have.
Sign up for a Free Forever account to add FIDO2 to your app in a few lines of code, or book time with our auth experts if you have questions.
