🔐 WebAuthn and Passkeys Awesome

Curated list of tools and projects related to WebAuthn and Passkeys

WebAuthn is a W3C standard that allows users to authenticate to websites using their preferred device. WebAuthn is supported by most browsers and platforms, and can be used with FIDO2, CTAP, U2F, and other devices.

Passkey is an umbrella term that basically means FIDO.

Contributions welcome. Add links through pull requests or create an issue to start a discussion. Please read the contribution guidelines before contributing.

Contents

• Demos
• Server Libraries
• Client Libraries
• Software Authenticators
• Hardware Authenticators
• Dev tools
• Specifications
• Tutorials
• Articles
• Slides
• Books
• Other
• FAQ

Demos

• DUO: WebAuthn Demo - A demonstration of the WebAuthn Specification https://webauthn.io/.
• Anders Åberg: .NET library for FIDO2 Demo - A working implementation library + demo for FIDO2 and WebAuthn using .NET https://fido2-net-lib.passwordless.dev/.
• Auth0: WebAuthn Demo - Probably the best WebAuthn flow demo.
• Google: WebAuthn Demo - An example Java Relying Party implementation of the WebAuthn specification https://webauthndemo.appspot.com.
• Yubico: WebAuthn Demo - Provides technical details of WebAuthn data flow and includes a playground to test a U2F/FIDO2 key as a second factor or passwordless key.
• jcjones: WebAuthn.bin.coffee DEMO - A simple site for testing Web Authentication https://webauthn.bin.coffee/.
• FIDO Alliance: Interop WebApp - As simple test app for FIDO2 servers.
• Spomky-Labs: Webauthn Demo - a demo based on Symfony and the PHP framework web-auth/webauthn-framework.
• Yuriy Ackermann: FIDO2 Demos - A set of demos for "Introduction to WebAuthn API".
• Shane Weeden: FIDO2 Viewer - This is a free, simple, standalone-in-the-browser viewer for FIDO2 attestation and assertion payload inspection.
• Xavier Renard: Webauthn Demo - A working WebAuthn demo based on java Spring Boot and react.js.
• Anders Rundgren: FIDO Web Pay - Public FIDO-based "wallet" demo and associated standards proposal.
• MasterKale: SimpleWebAuthn Demo - A working instance of the SimpleWebAuthn example project showcasing both its server and browser libraries.
• MasterKale: WebAuthn Debugger - A WebAuthn registration and authentication response previewer.
• WebAuthn Viewer - A GUI based WebAuthn API response viewer.
• Chris Keogh: dotnetcore IdentityServer4 DEMO - A WebAuthN demo using dotnetcore and the FIDO2.NET library that integrates passwordless auth with IdentityServer4.
• Firstyear: Webauthn RS demo and compatability tester - A demo of Webauthn using Webauthn-RS, with WASM browser components and an exhaustive device compatibility and stress tester.
• webauthn-skeleton: Node.js/Koa application - This is a working skeleton of a Node.js/Koa application with passwordless login (Web Authentication API, WebAuthN, FIDO2).
• Dashlane: Android passkey example app - An example Android application that demonstrates native passkey support.
• Passwordless.ID WebAuthn lib playground - Register, authenticate and verify WebAuthn credentials using this interactive playground.
• WebAuthn.Net Demo - Demonstration of usage scenarios with WebAuthn.Net and ASP.NET Core.
• Authsignal: Banking use case demo - An example of a banking use case with WebAuthn with automatic passkey upgrades feature.
• YubiKey WebAuthn Code Demo - Complete WebAuthn implementation with YubiKey showing discoverable credentials, traditional authentication flows, and full React/Express stack with proper server-side validation iraycd/yubikey-webauthn-demo.

Server Libraries

• FIDO CERTIFIED™ LINE: FIDO2 Server - FIDO2(WebAuthn) server officially certified by FIDO Alliance and Relying Party examples.
• FIDO CERTIFIED™ Hanko: Passkey Server - FIDO2-certified passkey & WebAuthn server written in Go. Includes a JavaScript client SDK and a passkey provider for Auth.js (Next-Auth).
• FIDO CONFORMANT Anders Åberg: .NET library for FIDO2 - A working implementation library + demo for fido2 and WebAuthn using .NET.
• FIDO CONFORMANT WebAuthn.Net - A production-ready, easy-to-use, extensible implementation of WebAuthn for web applications on ASP.NET Core + demo.
• FIDO CONFORMANT WebAuthn4J Project: WebAuthn4J - A portable Java library for WebAuthn server side verification.
• FIDO CONFORMANT WebAuthn Go library - WebAuthn library written in Go (replaces the archived and deprecated DUO: WebAuthn Go library).
• FIDO CONFORMANT cedarcode: WebAuthn Ruby - Ruby implementation of a WebAuthn Relying Party.
• FIDO CONFORMANT MasterKale: @simplewebauthn/server - WebAuthn, Simplified. A TypeScript-first Node.js library for simpler WebAuthn integration. Supports use in TypeScript and JavaScript projects. Partner library to the front end @simplewebauthn/browser (see Client Libs).
• FIDO CONFORMANT Eclipse Vert.x: WebAuthn - Reactive WebAuthn library for Eclipse Vert.x. Works with any Vert.x related framework: Vert.x Web, Quarkus, ES4X, etc.
• FIDO CONFORMANT Madwizard.org: WebAuthn PHP library - WebAuthn server library for PHP.
• FIDO CONFORMANT Spomky-Labs: WebAuthn Framework - This framework contains PHP libraries and Symfony bundle to allow developpers to integrate FIDO2 authentication mechanism into their web applications.
• FIDO CONFORMANT uzyn: Passcay - Passkey/WebAuthn library for Zig.
• Duo: py_webauthn - Pythonic WebAuthn. A Python3 implementation of the WebAuthn API focused on making it easy to leverage the power of WebAuthn.
• Yubico: Java WebAuthn Server - Server-side Web Authentication library for Java.
• webauthn-open-source: FIDO2 lib - A Node.js library for performing FIDO 2.0 / WebAuthn server functionality.
• Nov Matake: Ruby WebAuthn Lib - W3C Web Authentication API (a.k.a. WebAuthn / FIDO2) RP library in Ruby.
• Yubico: python-fido2 - FIDO2 Client and Server lib.
• Tangui: Wax - Elixir implementation of WebAuthn.
• Suby Raman: redux-webauthn - Redux middleware for registering and authenticating users with the Web Authentication API (FIDO2).
• Firstyear: WebAuthn-RS - An implementation of Passkeys and Webauthn components for Rust web servers.
• Koesie10: WebAuthn - Go/JS WebAuthn Library for easy Server/Client integation.
• SharpLab: Spring-Security-WebAuthn - Unofficial WebAuthn module for the Spring Security project.
• Wallix: @webauthn/server - A Node.js library containing easy-to-use helpers to integrate FIDO2. Works in pair with @webauthn/client.
• asbiin: laravel-webauthn - A Laravel adapter for the WebAuthn Framework (from Spomky-Labs).
• e3b0c442: warp - A framework-independent Relying Party implemnetation for Go.
• fumieval: webauthn - Fledgling Haskell implementation.
• lbuchs: PHP Webauthn - A simple PHP WebAuthn (FIDO2) server library.
• Robur: webauthn - An IO-agnostic WebAuthn server implementation written in OCaml.
• Passwordless.ID: WebAuthn lib - A simple, minimal, opinionated typescript wrapper around WebAuthn. Features both client side to invoke WebAuthn and server side to verify credentials.
• swift-server: webauthn-swift - A Swift library for implementing the WebAuthn specs on server.
• kanidm: webauthn-rs - An implementation of webauthn components for Rustlang servers.
• Passkeybot - Add passkey auth with a few server side HTTP handlers.

Client Libraries

• Yubico: python-fido2 - Client Lib to talk to a hardware authenticators over USB HID.
• Yubico: libfido2 - C client library and command-line tools to communicate with a FIDO device over USB, and to verify attestation and assertion signatures.
• keys.pub: go-libfido2 - Go client library (wraps Yubico: libfido2).
• Lyo Kato: iOS Webauthn Kit - This library provides you a way to handle W3C Web Authentication API (a.k.a. WebAuthN / FIDO 2.0) easily.
• Yubico: Mobile Android SDK (YubiKit) - YubiKit is an Android library provided by Yubico to interact with YubiKeys on Android devices. Works with other FIDO2 devices as well.
• Yubico: Mobile iOS SDK (YubiKit) - YubiKit is an iOS library provided by Yubico to interact with YubiKeys on iOS devices. Works with other FIDO2 devices as well.
• Mozilla: authenticator-rs - Rust library to interact with Security Keys, used by Firefox.
• Firstyear: webauthn-authenticator-rs - Rust library for interacting with Security Keys, based on authenticator-rs, but with extensions to support CTAP2.1 and NFC.
• COTECH: Hardware Security SDK - Android library to interact with FIDO2 and U2F security keys over NFC and USB. Also provides a WebAuthn-WebView bridge.
• MasterKale: @simplewebauthn/browser - WebAuthn, Simplified. A TypeScript-first browser library for simpler WebAuthn integration. Supports use in TypeScript and JavaScript projects. Partner library to the back end @simplewebauthn/server (see Server Libs). Also works with Duo's py_webauthn.
• Vault12: electron-webauthn-mac - Native WebAuthn/Passkey support for Electron on macOS using Apple's AuthenticationServices framework.
• Corbado: flutter-passkeys - Flutter package to provide passkey authentication for iOS and Android apps.
• WIOSense: rauth-android - Android library for FIDO2 roaming authenticator.

Software Authenticators

• FIDO CONFORMANT TheMaxMur: RS-Key - FIDO2/WebAuthn and U2F security-key firmware for the RP2350, written in Rust with reproducible builds; also implements OpenPGP, PIV and OATH.
• Damian Czaja: android-webauthn-token - A FIDO2 WebAuthn BLE Android phone token.
• Fabian Henneke: WearAuthn - FIDO2 Bluetooth HID/NFC soft token for Wear OS watches with support for resident keys.
• Radoslav Bodó: soft-webauthn - Python software webauthn token.
• adessoSE: softauthn - FIDO2 authenticator emulator/software token in Java.
• Daniel Stiner: Rust U2F - U2F security token emulator written in Rust.
• Firstyear: webauthn-authenticator-rs - Contains a software webauthn token with ephemeral attestation CA allowing richer testing of device policies.
• tjado mäcke: Authorizer - An Android password manager based on psafe3 files which supports FIDO2 WebAuthn over BLE.
• bulwarkid: virtual-fido - virtual-fido is an Golang based commandline application which emulates an USB security token. This can also be used as a library.
• bulwarkid: bulwark-passkeys - Bulwark passkeys is a desktop application written in Golang supporting CTAP2, similar to a platform-based authenticator.
• Pol Henarejos: pico-fido - This project transforms your Raspberry Pi Pico into an integrated FIDO Passkey, functioning like a standard USB Passkey for authentication
• Peter Sanford: TPM FIDO - tpm-fido is FIDO token implementation for Linux that protects the token keys by using your system's TPM.
• Scott Leggett: PIV Agent - An SSH and GPG agent which you can use with your PIV hardware security device (e.g. a Yubikey).
• Dashlane: Passkey Provider Demo for iOS - A demo passkey provider on iOS

Hardware Authenticators

• FIDO CERTIFIED™ SoloKeys - Solo is an open source FIDO2 security key, and you can get one at https://solokeys.com.
• FIDO CONFORMANT Conor Patrick: U2F Zero - U2F Zero is an open source U2F token for 2 factor authentication.
• Trezor - Trezor is an open source hardware wallet with FIDO/U2F and FIDO2/WebAuthn functionality.
• Google: OpenSK - OpenSK is an open-source implementation for security keys written in Rust that supports both FIDO U2F and FIDO2 standards.
• Nitrokey - Nitrokey is developing/producing different types of open source and open hardware FIDO2 security keys (check for the "Nitrokey FIDO2" and "Nitrokey 3" related repositories).
• BryanJacobs: FIDO2Applet - FIDO2 CTAP2 Javacard Applet.
• darconeous: u2f-javacard - A privacy-focused Java Card U2F Authenticator based on ledger-u2f-javacard (More recent fork of Ledger).

Dev tools

• Shane B Weeden: FIDO2 Postman Clients - FIDO2 Postman clients to easily test your FIDO2 API endpoints.
• MasterKale: WebAuthn Previewer - A simple website for previewing WebAuthn attestations and assertions.
• Firstyear: Webauthn RS compatability tester - A webauthn device and browser stress tester that can identify flaws in implementations and has already found bugs in Firefox, Safari, Android and more.
• Descope: VirtualWebAuthn Test Tool - A GO package to automate testing of a relying party WebAuthn server implementation without requiring a browser or an actual authenticator.
• Olivier Potonniée: FIDO MDS Explorer - A user-friendly web UI to explore the FIDO Metadata Service repository, which contains detailed characteristics and attestation certificates of authenticators registered to the FIDO Alliance.
• WebAuthn Playground - A web page (no server) to test WebAuthn operations with configurable parameters, and view/parse responses.
• Passkeys Debugger - A simple website to test different passkeys / WebAuthn server settings and client responses.
• Martin Paljak: YAFU - Yet Another FIDO Utility - Java library and CLI utility for working with CTAP devices over USBHID and NFC
• Passkey Origin Validator - CLI to verify Passkey Related Origin Request .well-known/webauthn configuration, shows label counts and origin matching.
• WebAuthnRecorder - Chrome extension for recording and analyzing WebAuthn API (navigator.credentials) calls.
• Passkey Generator - An engineer-friendly web UI for testing passkey and recovery signature(FIDO U2F-P256) with customizable parameters and visualization tools.

Specifications

• FIDO latest specifications - A right place to find most recent & original FIDO specifications.
• CTAP 2.1 specs- Client to Authenticator protocol v2.1
• WebAuthn draft- Webauthn draft
• CBOR specifications - A CBOR specification page with most recent updates and libraries for using CBOR in various programming languages.
• Credential Exchange Specifications - Credential Exchange Protocol (CXP) & Credential Exchange Format (CXF), working drafts

Tutorials

• Introduction to WebAuthn API - In depth article grinding through WebAuthn API, and how to use it.
• Passkeys.dev - A greate guide on starting with passkeys.
• WebAuthn Guide: DUOSEC - Great WebAuthn beginners guide by Suby Raman.
• Yubico Labs: WebAuthn Starter Kit Reference Deployment - How an identifier-first flow helps migrate users towards passwordless. Integrates Yubico's java-webauthn-server with AWS Lambda and AWS Cognito. Includes example web and iOS clients. See Reference Architecture.
• Yubico Labs: Securing a Website with Passwordless Authentication - Yubico java discoverable credentials workshop.
• Google: Your First WebAuthn - An awesome WebAuthn introduction by Eiji Kitamura @ Google.
• FIDO Alliance: How To FIDO - A definitive guide on good FIDO UI/UX.

Articles

• Yuriy Ackermann: WebAuthn/FIDO2 Blog - Great blog for those who wish to go in-depth with WebAuthn.
• Auth0: Introduction to Web Authentication - A fantastic introduction to WebAuthn by folks at Auth0.
• Watahani: のブログ - JP: 技術メモとか料理ネタとか.
• Eiji Kitamura: Credential Management API and best practices - Probably the best CredManAPI guide.
• Ken¥d: のブログ - JP: セキュリティ, Android, Cloud Nativeについてまとめるブログです.
• gebo: CTAP2 お勉強メモ ブログ - 認証,認可,FIDO,CTAP,NFC,BLE,c,c++,c#,Rust,ねこのげぼく.
• 上野博司/super_reader: Yahoo! JAPANでの生体認証の取り組み(FIDO2サーバーの仕組みについて) - Yahoo! JAPAN FIDO2 サーバーの仕組みに関するブログ.
• パスワードレス認証WebAuthnの勘所と対応状況 - WebAuthn API と基本的な FIDO 概念の概要.
• パスワードの不要な世界はいかにして実現されるのか - FIDO2 と WebAuthn の基本を知る - 北村さん、パスワードレスの世界づくりについて語る.
• Damien Bod: ASP.NET CORE IDENTITY WITH FIDO2 WEBAUTHN MFA - This article shows how Fido2 WebAuthn could be used as 2FA and integrated into an ASP.NET Core Identity application.
• Paul Stamatiou: Getting started with security keys - How to stay safe online and prevent phishing with FIDO2, WebAuthn and security keys. (Less technical but a very usefull article).
• Adam Powers FIDO Alliance: The Truth about Attestation - A woundeful tech article about attestations.
• Henrik Loeser (data-henrik): FIDO2-related blog articles - FIDO2 keys on Linux and for cloud services.
• Tim Brust: Security Evaluation of Multi-Factor Authentication in Comparison with the Web Authentication API - A master's thesis comparing WebAuthn with other multi-factor authentication methods, such as HOTP, TOTP or U2F.
• Stavros Korokithakis: How to use FIDO2 USB authenticators with SSH - Nice tutorial on how to use FIDO2 to authenticate SSH sessions. As short as possible, but as detailed as necessary to understood all important topics (e.g. resident vs. non-resident keys).
• webauthn.wft - A good overview with many detailed links to dig deeper if interested.
• Become Microsoft compatible security key vendor - A official guide to make your security keys Microsoft Entra compatible.

Slides

• Yuriy Ackermann: WebAuthn Overview - Introduction to WebAuthn Slide deck from 2019 talks.
• Implementing FIDO on Android Side using com.google.android.gms.fido.fido2 - Great guide for those who want to add passkey support to their Android app.
• WebAuthn Works: Slides - A library of slides by Yuriy Ackermann and WebAuthn Works in English and Russian.

Books

• Getting started with WebAuthn - コミックマーケット95で頒布した同人誌「Getting started with WebAuthn」の電子版(PDF)です.
• Password authentication for web and mobile apps - A book by Dmitry Chestnykh @dchest about authentication on web and mobile. Talks in depth about correct password authenticatoin, and additionally introduces to FIDO2/Webauthn.

Other

• DaryScam Project - Anti-phishing passkeys demos for instant messaging apps
• webauthn-open-source: WebAuthn Logos - Awesome webauthn logos by Adam Powers.
• CTAP2.1 Migration Guide - A guide for those who have CTAP2.0 authenticator, and they want to migrate to CTAP2.1
• Passkeys/WebAuthn Cheat Sheet - A 2-sided PDF explaining all relevant objects, concepts and ressources to implement passkeys.
• WebAuthn Wiki - WebAuthn API spec official explainers and wiki
• State of Passkeys - Info page that shows current data about passkey-readiness of operating systems and browsers
• ssheasy - SSH client that runs in the browser and implements WebAuthn based SSH authentication. WebAuthn authentication is implemented by implementing OpenSSH's webauthn-sk-ecdsa-sha2-nistp256@openssh.com key type in go and compiling it to WebAssembly.

FAQ

What is FIDO CERTIFIED™?

FIDO CERTIFIED means that implementation has passed FIDO conformance tools, passed interoperability even, and has achieved official FIDO Alliance certification. A registered FIDO Alliance Trademark.

What is FIDO CONFORMANT?

FIDO CONFORMANT means that implementation has passed FIDO conformance tools (as reported by the author), thus can claim that it is conformant with FIDO2 specifications. If you want to get access to the conformance tools, you can do it here https://fidoalliance.org/certification/functional-certification/conformance/. If you have passed conformance tools, send me a DM or a tweet @herrjemand with a screenshot of passing the tests.

FIDO2 or WebAuthn?

FIDO2 is the name of the standard. WebAuthn is just browser JS API to talk to the authenticators. So correct way to call your server is "FIDO2 Server" and to say "Authentication with FIDO2".

I would like to advertise my company product here!

Please don't. The advertisement you can get is by writing a good, deep, technical article, or open sourcing your server or/and tools is much better for you, than cheap show off. People will buy your company product if you show them that you know what you are doing.

Otherwise we have strict no ads policy. We will only link to open source repos and actual articles. No company websites.