FIDO2 / WebAuthn
What is FIDO2 / WebAuthn?
FIDO2 is the joint FIDO Alliance + W3C standard for passwordless + phishing-resistant authentication composed of: (a) W3C WEB AUTHENTICATION (WebAuthn) Level 3 Recommendation - the browser + relying party API for public-key credential creation + authentication; (b) FIDO CLIENT-TO-AUTHENTICATOR PROTOCOL 2.1 (CTAP2.1) - the protocol between client devices + roaming or platform authenticators; (c) FIDO METADATA SERVICE v3 (MDS3) - the trust + attestation metadata for authenticators including AAGUIDs + status reports + transports + algorithms; (d) DISCOVERABLE CREDENTIALS / PASSKEYS - resident-credential storage on authenticators enabling passwordless workflows + cross-device synchronisation via iCloud Keychain + Google Password Manager + Windows Hello + 1Password / Bitwarden / Dashlane. Core security properties: PHISHING RESISTANCE through origin binding + RP ID validation + channel binding; UNPHISHABLE WITHOUT USER INTERVENTION (no shared secrets); BIOMETRICS + PIN VERIFICATION local to the authenticator (never transmitted); REPLAY RESISTANCE through challenge-based protocol + signature counter + anti-replay timestamping; ENTERPRISE ATTESTATION + AAGUID ALLOWLISTING for managed-device deployments. It comprises 16 controls organised across 7 domains, and applies in International (FIDO Alliance/W3C).
How FIDO2 / WebAuthn maps to other frameworks
All 16 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 7 domains FIDO2 / WebAuthn groups its controls into
Where FIDO2 / WebAuthn overlaps with the standards you already hold
What FIDO2 / WebAuthn means in your sector
What FIDO2 / WebAuthn means for your job
Questions people ask about FIDO2 / WebAuthn
What is FIDO2 / WebAuthn?
How many controls does FIDO2 / WebAuthn have?
Where does FIDO2 / WebAuthn apply?
What frameworks does FIDO2 / WebAuthn map to?
How do I get started with FIDO2 / WebAuthn compliance?
Query FIDO2 / WebAuthn programmatically
FIDO2 / WebAuthn, its 16 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
FIDO2 / WebAuthn API reference and MCP config →How ready are you for FIDO2 / WebAuthn?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.