Glossary
FIDO2 is an open authentication standard, developed by the FIDO Alliance and W3C, that enables passwordless, phishing-resistant login using public-key cryptography. It’s the technical foundation beneath passkeys and modern passwordless authentication, and it comprises two specifications working together: WebAuthn and CTAP.
FIDO2 exists to kill the shared secret. Passwords, and even one-time codes, can be phished because the user transmits something an attacker can capture and replay. FIDO2 replaces that with a cryptographic handshake in which nothing reusable is ever sent.
Together they let a user authenticate to a website using a private key held on their device or a hardware key, with the site only ever seeing a public key and a signature.
FIDO2 credentials are bound to a specific origin, the legitimate site they were registered with. A phishing site at a different domain can’t elicit a valid signature, so the credential is useless to an attacker who tricks the user onto a fake page. This origin-binding is what makes FIDO2 fundamentally stronger than passwords or OTP-based MFA, both of which can be relayed through a real-time phishing proxy.
Passkeys are, in effect, FIDO2 credentials made consumer-friendly, with cross-device sync and a smooth UX layered on top of the standard. Transmit Security is a member of the FIDO Alliance board and builds FIDO2/passkey support into its authentication stack, pairing the standard with a risk engine to secure the lifecycle around it (recovery, fallback, device loss) where the standard alone leaves decisions to implementers.
The clearest way to see FIDO2’s advantage is against the MFA it replaces. Traditional MFA (a password plus an SMS code, an authenticator app, or a push) still passes a secret the user can be tricked into revealing. A real-time phishing proxy relays the password and the code to the real site in the moment; the user has no way to tell the fake page from the real one. FIDO2 removes that possibility structurally. There’s no code to relay, and the credential is cryptographically bound to the legitimate site’s origin, so it simply won’t produce a signature on a phishing domain. This is why standards bodies and security teams increasingly class FIDO2/passkeys as "phishing-resistant" and everything based on shared codes as merely "phishable but better than nothing." For high-value accounts, that distinction is the whole argument.
What is FIDO2 used for?
Passwordless, phishing-resistant authentication, it’s the standard behind passkeys.
What are the components of FIDO2?
WebAuthn (the web API) and CTAP (the client-to-authenticator protocol).
Is FIDO2 the same as passkeys?
Passkeys are consumer-friendly FIDO2 credentials with cross-device sync; FIDO2 is the underlying standard.
Why is FIDO2 better than SMS or app-based MFA?
There’s no code to phish and the credential is bound to the real site’s origin, so real-time phishing can’t relay it.
Do I need special hardware for FIDO2?
No, modern phones and laptops act as authenticators, though hardware security keys are also supported.
Who maintains the FIDO2 standard?
The FIDO Alliance, together with the W3C for the WebAuthn component.
Related: WebAuthn · CTAP · Passkeys · Passwordless Authentication · FIDO Alliance
