herrjemand / awesome-webauthn

🔐 A curated list of awesome WebAuthn and Passkey resources

🔐 WebAuthn Awesome

Curated list of tools and projects related to WebAuthn and Passkeys

WebAuthn is a W3C standard that allows users to authenticate to websites using their preferred device. WebAuthn is supported by most browsers and platforms, and can be used with FIDO2, CTAP, U2F, and other devices.

Passkey is an umbrella term that basically means FIDO.

Contributions welcome. Add links through pull requests or create an issue to start a discussion. Please read the contribution guidelines before contributing.

Contents

• Demos
• Server Libraries
• Client Libraries
• Software Authenticators
• Hardware Authenticators
• Dev tools
• Tutorials
• Articles
• Slides
• Books
• Other
• FAQ

Demos

• DUO: WebAuthn Demo - A demonstration of the WebAuthn Specification https://webauthn.io/.
• Anders Åberg: .NET library for FIDO2 Demo - A working implementation library + demo for FIDO2 and WebAuthn using .NET https://fido2-net-lib.passwordless.dev/.
• Auth0: WebAuthn Demo - Probably the best WebAuthn flow demo.
• Google: WebAuthn Demo - An example Java Relying Party implementation of the WebAuthn specification https://webauthndemo.appspot.com.
• Yubico: WebAuthn Demo - Provides technical details of WebAuthn data flow and includes a playground to test a U2F/FIDO2 key as a second factor or passwordless key.
• jcjones: WebAuthn.bin.coffee DEMO - A simple site for testing Web Authentication https://webauthn.bin.coffee/.
• FIDO Alliance: Interop WebApp - As simple test app for FIDO2 servers.
• Spomky-Labs: Webauthn Demo - a demo based on Symfony and the PHP framework web-auth/webauthn-framework.
• Yuriy Ackermann: FIDO2 Demos - A set of demos for "Introduction to WebAuthn API".
• Shane Weeden: FIDO2 Viewer - This is a free, simple, standalone-in-the-browser viewer for FIDO2 attestation and assertion payload inspection.
• Xavier Renard: Webauthn Demo - A working WebAuthn demo based on java Spring Boot and react.js.
• Anders Rundgren: FIDO Web Pay - Public FIDO-based "wallet" demo and associated standards proposal.
• MasterKale: SimpleWebAuthn Demo - A working instance of the SimpleWebAuthn example project showcasing both its server and browser libraries.
• MasterKale: WebAuthn Debugger - A WebAuthn registration and authentication response previewer.
• WebAuthn Viewer - A GUI based WebAuthn API response viewer.
• Chris Keogh: dotnetcore IdentityServer4 DEMO - A WebAuthN demo using dotnetcore and the FIDO2.NET library that integrates passwordless auth with IdentityServer4.
• Firstyear: Webauthn RS demo and compatability tester - A demo of Webauthn using Webauthn-RS, with WASM browser components and an exhaustive device compatibility and stress tester.
• webauthn-skeleton: Node.js/Koa application - This is a working skeleton of a Node.js/Koa application with passwordless login (Web Authentication API, WebAuthN, FIDO2).
• Dashlane: Android passkey example app - An example Android application that demonstrates native passkey support.
• Passwordless.ID WebAuthn lib playground - Register, authenticate and verify WebAuthn credentials using this interactive playground.
• WebAuthn.Net Demo - Demonstration of usage scenarios with WebAuthn.Net and ASP.NET Core 8.

Server Libraries

• FIDO CERTIFIED™ LINE: FIDO2 Server - FIDO2(WebAuthn) server officially certified by FIDO Alliance and Relying Party examples.
• FIDO CERTIFIED™ Hanko: Passkey Server - FIDO2-certified passkey & WebAuthn server written in Go. Includes a JavaScript client SDK and a passkey provider for Auth.js (Next-Auth).
• FIDO CONFORMANT Anders Åberg: .NET library for FIDO2 - A working implementation library + demo for fido2 and WebAuthn using .NET.
• FIDO CONFORMANT WebAuthn.Net - A production-ready, easy-to-use, extensible implementation of WebAuthn for web applications on .NET 6 and .NET 8 + demo.
• FIDO CONFORMANT WebAuthn4J Project: WebAuthn4J - A portable Java library for WebAuthn server side verification.
• FIDO CONFORMANT WebAuthn Go library - WebAuthn library written in Go (replaces the archived and deprecated DUO: WebAuthn Go library).
• FIDO CONFORMANT cedarcode: WebAuthn Ruby - Ruby implementation of a WebAuthn Relying Party.
• FIDO CONFORMANT MasterKale: @simplewebauthn/server - WebAuthn, Simplified. A TypeScript-first Node.js library for simpler WebAuthn integration. Supports use in TypeScript and JavaScript projects. Partner library to the front end @simplewebauthn/browser (see Client Libs).
• FIDO CONFORMANT Eclipse Vert.x: WebAuthn - Reactive WebAuthn library for Eclipse Vert.x. Works with any Vert.x related framework: Vert.x Web, Quarkus, ES4X, etc.
• FIDO CONFORMANT Madwizard.org: WebAuthn PHP library - WebAuthn server library for PHP.
• FIDO CONFORMANT Spomky-Labs: WebAuthn Framework - This framework contains PHP libraries and Symfony bundle to allow developpers to integrate FIDO2 authentication mechanism into their web applications.
• Duo: py_webauthn - Pythonic WebAuthn. A Python3 implementation of the WebAuthn API focused on making it easy to leverage the power of WebAuthn.
• Yubico: Java WebAuthn Server - Server-side Web Authentication library for Java.
• webauthn-open-source: FIDO2 lib - A Node.js library for performing FIDO 2.0 / WebAuthn server functionality.
• Nov Matake: Ruby WebAuthn Lib - W3C Web Authentication API (a.k.a. WebAuthn / FIDO2) RP library in Ruby.
• Yubico: python-fido2 - FIDO2 Client and Server lib.
• Tangui: Wax - Elixir implementation of WebAuthn.
• Suby Raman: redux-webauthn - Redux middleware for registering and authenticating users with the Web Authentication API (FIDO2).
• Firstyear: WebAuthn-RS - An implementation of Passkeys and Webauthn components for Rust web servers.
• Koesie10: WebAuthn - Go/JS WebAuthn Library for easy Server/Client integation.
• SharpLab: Spring-Security-WebAuthn - Unofficial WebAuthn module for the Spring Security project.
• Wallix: @webauthn/server - A Node.js library containing easy-to-use helpers to integrate FIDO2. Works in pair with @webauthn/client.
• asbiin: laravel-webauthn - A Laravel adapter for the WebAuthn Framework (from Spomky-Labs).
• e3b0c442: warp - A framework-independent Relying Party implemnetation for Go.
• fumieval: webauthn - Fledgling Haskell implementation.
• lbuchs: PHP Webauthn - A simple PHP WebAuthn (FIDO2) server library.
• Robur: webauthn - An IO-agnostic WebAuthn server implementation written in OCaml.
• Passwordless.ID: WebAuthn lib - A simple, minimal, opinionated typescript wrapper around WebAuthn. Features both client side to invoke WebAuthn and server side to verify credentials.
• swift-server: webauthn-swift - A Swift library for implementing the WebAuthn specs on server.

Client Libraries

• Yubico: python-fido2 - Client Lib to talk to a hardware authenticators over USB HID.
• Yubico: libfido2 - C client library and command-line tools to communicate with a FIDO device over USB, and to verify attestation and assertion signatures.
• keys.pub: go-libfido2 - Go client library (wraps Yubico: libfido2).
• Lyo Kato: iOS Webauthn Kit - This library provides you a way to handle W3C Web Authentication API (a.k.a. WebAuthN / FIDO 2.0) easily.
• Yubico: Mobile Android SDK (YubiKit) - YubiKit is an Android library provided by Yubico to interact with YubiKeys on Android devices. Works with other FIDO2 devices as well.
• Yubico: Mobile iOS SDK (YubiKit) - YubiKit is an iOS library provided by Yubico to interact with YubiKeys on iOS devices. Works with other FIDO2 devices as well.
• Mozilla: authenticator-rs - Rust library to interact with Security Keys, used by Firefox.
• Firstyear: webauthn-authenticator-rs - Rust library for interacting with Security Keys, based on authenticator-rs, but with extensions to support CTAP2.1 and NFC.
• COTECH: Hardware Security SDK - Android library to interact with FIDO2 and U2F security keys over NFC and USB. Also provides a WebAuthn-WebView bridge.
• MasterKale: @simplewebauthn/browser - WebAuthn, Simplified. A TypeScript-first browser library for simpler WebAuthn integration. Supports use in TypeScript and JavaScript projects. Partner library to the back end @simplewebauthn/server (see Server Libs). Also works with Duo's py_webauthn.
• Corbado: flutter-passkeys - Flutter package to provide passkey authentication for iOS and Android apps.
• WIOSense: rauth-android - Android library for FIDO2 roaming authenticator.

Software Authenticators

• Damian Czaja: android-webauthn-token - A FIDO2 WebAuthn BLE Android phone token.
• Fabian Henneke: WearAuthn - FIDO2 Bluetooth HID/NFC soft token for Wear OS watches with support for resident keys.
• Radoslav Bodó: soft-webauthn - Python software webauthn token.
• adessoSE: softauthn - FIDO2 authenticator emulator/software token in Java.
• Daniel Stiner: Rust U2F - U2F security token emulator written in Rust.
• Firstyear: webauthn-authenticator-rs - Contains a software webauthn token with ephemeral attestation CA allowing richer testing of device policies.
• tjado mäcke: Authorizer - An Android password manager based on psafe3 files which supports FIDO2 WebAuthn over BLE.
• bulwarkid: virtual-fido - virtual-fido is an Golang based commandline application which emulates an USB security token. This can also be used as a library.
• bulwarkid: bulwark-passkeys - Bulwark passkeys is a desktop application written in Golang supporting CTAP2, similar to a platform-based authenticator.

Hardware Authenticators

• FIDO CERTIFIED™ SoloKeys - Solo is an open source FIDO2 security key, and you can get one at https://solokeys.com.
• FIDO CONFORMANT Conor Patrick: U2F Zero - U2F Zero is an open source U2F token for 2 factor authentication.
• Trezor - Trezor is an open source hardware wallet with FIDO/U2F and FIDO2/WebAuthn functionality.
• Google: OpenSK - OpenSK is an open-source implementation for security keys written in Rust that supports both FIDO U2F and FIDO2 standards.
• Nitrokey - Nitrokey is developing/producing different types of open source and open hardware FIDO2 security keys (check for the "Nitrokey FIDO2" and "Nitrokey 3" related repositories).
• BryanJacobs: FIDO2Applet - FIDO2 CTAP2 Javacard Applet.
• darconeous: u2f-javacard - A privacy-focused Java Card U2F Authenticator based on ledger-u2f-javacard (More recent fork of Ledger).

Dev tools

• Shane B Weeden: FIDO2 Postman Clients - FIDO2 Postman clients to easily test your FIDO2 API endpoints.
• MasterKale: WebAuthn Previewer - A simple website for previewing WebAuthn attestations and assertions.
• Firstyear: Webauthn RS compatability tester - A webauthn device and browser stress tester that can identify flaws in implementations and has already found bugs in Firefox, Safari, Android and more.
• Descope: VirtualWebAuthn Test Tool - A GO package to automate testing of a relying party WebAuthn server implementation without requiring a browser or an actual authenticator.
• FIDO MDS Explorer - A user-friendly web UI to explore the FIDO Metadata Service repository, which contains detailed characteristics and attestation certificates of authenticators registered to the FIDO Alliance.
• WebAuthn Playground - A web page (no server) to test WebAuthn operations with configurable parameters, and view/parse responses.

Tutorials

• Introduction to WebAuthn API - In depth article grinding through WebAuthn API, and how to use it.
• Passkeys.dev - A greate guide on starting with passkeys.
• WebAuthn Guide: DUOSEC - Great WebAuthn beginners guide by Suby Raman.
• Yubico Labs: WebAuthn Starter Kit Reference Deployment - How an identifier-first flow helps migrate users towards passwordless. Integrates Yubico's java-webauthn-server with AWS Lambda and AWS Cognito. Includes example web and iOS clients. See Reference Architecture.
• Yubico Labs: Securing a Website with Passwordless Authentication - Yubico java discoverable credentials workshop.
• Google: Your First WebAuthn - An awesome WebAuthn introduction by Eiji Kitamura @ Google.
• FIDO Alliance: How To FIDO - A definitive guide on good FIDO UI/UX.

Articles

• Yuriy Ackermann: WebAuthn/FIDO2 Blog - Great blog for those who wish to go in-depth with WebAuthn.
• Auth0: Introduction to Web Authentication - A fantastic introduction to WebAuthn by folks at Auth0.
• Watahani: のブログ - JP: 技術メモとか料理ネタとか.
• Eiji Kitamura: Credential Management API and best practices - Probably the best CredManAPI guide.
• Ken¥d: のブログ - JP: セキュリティ, Android, Cloud Nativeについてまとめるブログです.
• gebo: CTAP2 お勉強メモ ブログ - 認証,認可,FIDO,CTAP,NFC,BLE,c,c++,c#,Rust,ねこのげぼく.
• 上野博司/super_reader: Yahoo! JAPANでの生体認証の取り組み(FIDO2サーバーの仕組みについて) - Yahoo! JAPAN FIDO2 サーバーの仕組みに関するブログ.
• パスワードレス認証WebAuthnの勘所と対応状況 - WebAuthn API と基本的な FIDO 概念の概要.
• パスワードの不要な世界はいかにして実現されるのか - FIDO2 と WebAuthn の基本を知る - 北村さん、パスワードレスの世界づくりについて語る.
• Damien Bod: ASP.NET CORE IDENTITY WITH FIDO2 WEBAUTHN MFA - This article shows how Fido2 WebAuthn could be used as 2FA and integrated into an ASP.NET Core Identity application.
• Paul Stamatiou: Getting started with security keys - How to stay safe online and prevent phishing with FIDO2, WebAuthn and security keys. (Less technical but a very usefull article).
• Adam Powers FIDO Alliance: The Truth about Attestation - A woundeful tech article about attestations.
• Henrik Loeser (data-henrik): FIDO2-related blog articles - FIDO2 keys on Linux and for cloud services.
• Tim Brust: Security Evaluation of Multi-Factor Authentication in Comparison with the Web Authentication API - A master's thesis comparing WebAuthn with other multi-factor authentication methods, such as HOTP, TOTP or U2F.
• Stavros Korokithakis: How to use FIDO2 USB authenticators with SSH - Nice tutorial on how to use FIDO2 to authenticate SSH sessions. As short as possible, but as detailed as necessary to understood all important topics (e.g. resident vs. non-resident keys).
• webauthn.wft - A good overview with many detailed links to dig deeper if interested.

Slides

• Yuriy Ackermann: WebAuthn Overview - Introduction to WebAuthn Slide deck from 2019 talks.
• Implementing FIDO on Android Side using com.google.android.gms.fido.fido2 - Great guide for those who want to add passkey support to their Android app.
• WebAuthn Works: Slides - A library of slides by Yuriy Ackermann and WebAuthn Works in English and Russian.

Books

• Getting started with WebAuthn - コミックマーケット95で頒布した同人誌「Getting started with WebAuthn」の電子版(PDF)です.
• Password authentication for web and mobile apps - A book by Dmitry Chestnykh @dchest about authentication on web and mobile. Talks in depth about correct password authenticatoin, and additionally introduces to FIDO2/Webauthn.

Other

• webauthn-open-source: WebAuthn Logos - Awesome webauthn logos by Adam Powers.
• CTAP2.1 Migration Guide - A guide for those who have CTAP2.0 authenticator, and they want to migrate to CTAP2.1
• Passkeys/WebAuthn Cheat Sheet - A 2-sided PDF explaining all relevant objects, concepts and ressources to implement passkeys.
• WebAuthn Wiki - WebAuthn API spec official explainers and wiki

FAQ

What is FIDO CERTIFIED™?

FIDO CERTIFIED means that implementation has passed FIDO conformance tools, passed interoperability even, and has achieved official FIDO Alliance certification. A registered FIDO Alliance Trademark.

What is FIDO CONFORMANT?

FIDO CONFORMANT means that implementation has passed FIDO conformance tools (as reported by the author), thus can claim that it is conformant with FIDO2 specifications. If you want to get access to the conformance tools, you can do it here https://fidoalliance.org/certification/functional-certification/conformance/. If you have passed conformance tools, send me a DM or a tweet @herrjemand with a screenshot of passing the tests.

FIDO2 or WebAuthn?

FIDO2 is the name of the standard. WebAuthn is just browser JS API to talk to the authenticators. So correct way to call your server is "FIDO2 Server" and to say "Authentication with FIDO2".

I would like to advertise my company product here!

Please don't. The advertisement you can get is by writing a good, deep, technical article, or open sourcing your server or/and tools is much better for you, than cheap show off. People will buy your company product if you show them that you know what you are doing.

Otherwise we have strict no ads policy. We will only link to open source repos and actual articles. No company websites.

awesome-webauthn's Issues

Android 14 native app passkey example

Would it be appropriate to link to this repo?

https://github.com/Dashlane/android-passkey-example

It's a demo app for Android 14 that allows testing passkey registration and authentication.

Add OpenAPI spec

Hi! Not a request but more of a todo list item for me. I have a fully conformant OpenAPI spec for WebAuthn painstakingly copied from the official specification. I'm keen to pull this out into its own resource so it can be valuable for others to use. Let me know if that would be useful and I can get it up into a standalone repo and maybe linked here in the coming weeks.

The WebAuthn API spec itself is buried inside the Storyden API spec for anyone who finds this via Google search: https://github.com/Southclaws/storyden/blob/main/api/openapi.yaml#L1107-L1333

Add Webauthn-RS demo and compatability tester

https://webauthn.firstyear.id.au/

Contains both a demo of the webauthn-rs library, and an exhausting compatibilty test that exercises keys to see if they work correctly.

go: duo webauthn natural successor

Hey there! The library github.com/duo-labs/webauthn has been archived (see here) and replaced by github.com/go-webauthn/webauthn. I am the principal maintainer of this org. With the help of several users this library now supports MDS3 (original only supports MDS2).

It should theoretically be as conformant as the original as it's a direct fork with mostly bug fixes and sensible feature additions, though we have not expressly completed any conformance testing.

How would you like to proceed with this? Would you like me to mark the original as deprecated (and how would you like this to appear) and add github.com/go-webauthn/webauthn under it as conformant or not mark it as such until we've completed formal conformance testing? Or do you want to handle this yourself?

Secure Payment Confirmation

Yuriy, you need to add https://github.com/rsolomakhin/secure-payment-confirmation to your list of awesome webauthn stuff since it is targeted to be the future for secure on-line payments.

Personally I believe this is giant mistake created by a very small group of people but since it is powered by Google this is probably = FIDO, right? I'm not aware of any other payment effort that are betting on 3DS/step-up authentication.

As you probably know EMV cards is the only real standard for secure payments. However, EMV never made it on the Web (except by keying in card numbers...). Therefore my suggestion is simply to create a Web-adapted version of EMV that unlike EMV also can work with most other payment networks including the EURO-zone's SEPA. That is, the proposed system is even more universal than EMV. The concept has been extensively tested but not with FIDO because that requires browser support.

please link to "how to fido" in "Tutorials" section

https://github.com/fido-alliance/how-to-fido/blob/master/HowToFIDO.md

thx, =JeffH

Enterprise JSF WebAuthn Demo

Maybe interesting is the Enterprise JSF WebAuthn Demo, available at:
https://demo.e-contract.be/ejsf-demo/webauthn.xhtml

Here we constructed a Jakarta Server Faces component to ease integration of WebAuthn within JSF based web applications. We even support the PRF extension.

The source code of this project is available at GitHub:
https://github.com/e-Contract/enterprise-jsf

Updates about the software authenticator mentioned in curated list

Software authenticator mentioned in the repository does not work to date

Hello @herrjemand , I have been trying to use the Damian Czaja: android-webauthn-token BLE authenticator mobile app , it does not work in any Android 11 or above platform , the Google Chrome Browser in the Mobile Phone works fine and helps in passwordless-logins to any websites . I also built the app on my Physical Device(based on Android 13) and tried using app to login but it didn't simply work . Just informing you as I feel that this app is trivial till date .

giangprokhoa

Information: Become a Microsoft-compatible FIDO2 security key vendor

Maybe useful, but I'm not the stockholder of this information...
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-fido2-hardware-vendor

Hardware devices missing...

The section on hardware authenticators is quite empty

Basically everything Feitian, OnlyKey, Hapersecu, the Yubi stuff and similar things are missing. Not to talk about all the obscure Chinese "works but nobody can tell you how safe they are" USB devices.

Add passkeys.com

Hi, I have a very helpful passkeys resource to add: passkeys.com.
The only passkeys online debugger I know, and out of the box examples for quick start with passkeys implementation.
I opened a PR for it -
#81

WebAuthn.Net - open source .NET server library

My team and I have developed the WebAuthn.Net library for the .NET ecosystem.
It is open source under the MIT license and serves as an alternative to fido2-net-lib.
Our library passes all FIDO2 Server - MDS3 Tests (including all optional parameters) in the FIDO Conformance Tool 1.7.17.
We have submitted the test results using this tool.
The library includes a demonstration host and instructions on how to perform similar tests independently (if someone does not trust our results, they can perform a similar verification on their own).

I would like to know how we can be included in the Server Libraries list, and is there anything else we need to do for our library to be marked as FIDO CONFORMANT in this list?
Is it enough to make a PR to this repository, or are there any additional verification steps required?

Mastercard demo link returns 404

https://github.com/Mastercard/fido2-rp-spring