How FIDO2 and WebAuthn make phishing structurally impossible
FIDO2 replaces the shared secret with a key pair and binds the credential to the site's origin. That single design choice is why passkeys resist phishing where passwords and one-time codes cannot.
The core idea
FIDO2 = WebAuthn (the browser/web API, from W3C) + CTAP (the protocol to the authenticator, from the FIDO Alliance). Instead of a shared password, your device holds a private key that never leaves it, and the matching public key sits on the server. Authentication is a signed challenge, and the browser will only use the credential on the exact origin it was registered to. There is no secret to phish and no code to relay.
Public keys instead of shared secrets
With passwords, the server stores something that, if stolen, lets an attacker log in — and the user hands that same secret over on every login, which is what phishing captures. FIDO2 flips this. Registration generates a public/private key pair on the authenticator (a security key, phone, or laptop secure element). The private key never leaves the device; the server only ever sees the public key. A server breach therefore leaks public keys, which are useless to an attacker.
Origin binding is what kills phishing
When you log in, the server sends a random challenge. The authenticator signs it with the private key — but only after the browser confirms the request comes from the same origin (the RP ID) the credential was registered to. A phishing site at a look-alike domain has a different origin, so the browser simply will not release the credential. The user cannot be tricked into using their key on the wrong site, because the decision is made by the browser against a cryptographic identifier, not by the human reading a URL. The random challenge also defeats replay.
- **WebAuthn** — the W3C standard API that web apps and browsers use to create and use credentials.
- **CTAP** (Client to Authenticator Protocol) — the FIDO Alliance protocol between the client (browser/OS) and an external authenticator over USB, NFC, or Bluetooth.
- **User verification** — a biometric or PIN checked locally by the authenticator, turning possession of the device into a genuine second factor.
- **Passkey** — the consumer-friendly name for a discoverable FIDO credential you can use without typing a username.
Phishing-resistant is not account-recovery-resistant
The strong part of FIDO2 is the login. The weak point in real deployments is the fallback: if a lost passkey drops the user back to an SMS code or a knowledge-based question, an attacker just targets that path instead. Design recovery to be as strong as the primary factor, or the phishing resistance is only skin-deep.