🔐 A curated list of awesome WebAuthn and Passkey resources
This page lists names, links and short descriptions. The original list on GitHub is the source and belongs to its authors.
is a W3C standard that allows users to authenticate to websites using their preferred device. WebAuthn is supported by most browsers and platforms, and can be used with FIDO2, CTAP, U2F, and other devices.
A demonstration of the WebAuthn Specification https://webauthn.io/.
A working implementation library + demo for FIDO2 and WebAuthn using .NET https://fido2-net-lib.passwordless.dev/.
Probably the best WebAuthn flow demo.
An example Java Relying Party implementation of the WebAuthn specification https://webauthndemo.appspot.com.
Provides technical details of WebAuthn data flow and includes a playground to test a U2F/FIDO2 key as a second factor or passwordless key.
A simple site for testing Web Authentication https://webauthn.bin.coffee/.
As simple test app for FIDO2 servers.
a demo based on Symfony and the PHP framework web-auth/webauthn-framework.
A set of demos for "Introduction to WebAuthn API".
This is a free, simple, standalone-in-the-browser viewer for FIDO2 attestation and assertion payload inspection.
A working WebAuthn demo based on java Spring Boot and react.js.
Public FIDO-based "wallet" demo and associated standards proposal.
A working instance of the SimpleWebAuthn example project showcasing both its server and browser libraries.
A WebAuthn registration and authentication response previewer.
A GUI based WebAuthn API response viewer.
A WebAuthN demo using dotnetcore and the FIDO2.NET library that integrates passwordless auth with IdentityServer4.
A demo of Webauthn using Webauthn-RS, with WASM browser components and an exhaustive device compatibility and stress tester.
This is a working skeleton of a Node.js/Koa application with passwordless login (Web Authentication API, WebAuthN, FIDO2).
An example Android application that demonstrates native passkey support.
Register, authenticate and verify WebAuthn credentials using this interactive playground.
Demonstration of usage scenarios with WebAuthn.Net and ASP.NET Core.
An example of a banking use case with WebAuthn with automatic passkey upgrades feature.
Complete WebAuthn implementation with YubiKey showing discoverable credentials, traditional authentication flows, and full React/Express stack with proper server-side validation iraycd/yubikey-webauthn-demo.
Pythonic WebAuthn. A Python3 implementation of the WebAuthn API focused on making it easy to leverage the power of WebAuthn.
Server-side Web Authentication library for Java.
A Node.js library for performing FIDO 2.0 / WebAuthn server functionality.
W3C Web Authentication API (a.k.a. WebAuthn / FIDO2) RP library in Ruby.
FIDO2 Client and Server lib.
Elixir implementation of WebAuthn.
Redux middleware for registering and authenticating users with the Web Authentication API (FIDO2).
An implementation of Passkeys and Webauthn components for Rust web servers.
Go/JS WebAuthn Library for easy Server/Client integation.
Unofficial WebAuthn module for the Spring Security project.
A Node.js library containing easy-to-use helpers to integrate FIDO2. Works in pair with @webauthn/client.
A Laravel adapter for the WebAuthn Framework (from Spomky-Labs).
A framework-independent Relying Party implemnetation for Go.
Fledgling Haskell implementation.
A simple PHP WebAuthn (FIDO2) server library.
An IO-agnostic WebAuthn server implementation written in OCaml.
A simple, minimal, opinionated typescript wrapper around WebAuthn. Features both client side to invoke WebAuthn and server side to verify credentials.
A Swift library for implementing the WebAuthn specs on server.
An implementation of webauthn components for Rustlang servers.
Add passkey auth with a few server side HTTP handlers.
FIDO2 Client and Server lib.
C client library and command-line tools to communicate with a FIDO device over USB, and to verify attestation and assertion signatures.
Go client library (wraps Yubico: libfido2).
This library provides you a way to handle W3C Web Authentication API (a.k.a. WebAuthN / FIDO 2.0) easily.
YubiKit is an Android library provided by Yubico to interact with YubiKeys on Android devices. Works with other FIDO2 devices as well.
YubiKit is an iOS library provided by Yubico to interact with YubiKeys on iOS devices. Works with other FIDO2 devices as well.
Rust library to interact with Security Keys, used by Firefox.
An implementation of Passkeys and Webauthn components for Rust web servers.
Android library to interact with FIDO2 and U2F security keys over NFC and USB. Also provides a WebAuthn-WebView bridge.
WebAuthn, Simplified. A TypeScript-first browser library for simpler WebAuthn integration. Supports use in TypeScript and JavaScript projects. Partner library to the back end @simplewebauthn/server (see Server Libs). Also works with Duo's py_webauthn.
Native WebAuthn/Passkey support for Electron on macOS using Apple's AuthenticationServices framework.
Flutter package to provide passkey authentication for iOS and Android apps.
Android library for FIDO2 roaming authenticator.
A FIDO2 WebAuthn BLE Android phone token.
FIDO2 Bluetooth HID/NFC soft token for Wear OS watches with support for resident keys.
Python software webauthn token.
FIDO2 authenticator emulator/software token in Java.
U2F security token emulator written in Rust.
An implementation of Passkeys and Webauthn components for Rust web servers.
An Android password manager based on psafe3 files which supports FIDO2 WebAuthn over BLE.
virtual-fido is an Golang based commandline application which emulates an USB security token. This can also be used as a library.
Bulwark passkeys is a desktop application written in Golang supporting CTAP2, similar to a platform-based authenticator.
This project transforms your Raspberry Pi Pico into an integrated FIDO Passkey, functioning like a standard USB Passkey for authentication
tpm-fido is FIDO token implementation for Linux that protects the token keys by using your system's TPM.
An SSH and GPG agent which you can use with your PIV hardware security device (e.g. a Yubikey).
A demo passkey provider on iOS
Trezor is an open source hardware wallet with FIDO/U2F and FIDO2/WebAuthn functionality.
OpenSK is an open-source implementation for security keys written in Rust that supports both FIDO U2F and FIDO2 standards.
Nitrokey is developing/producing different types of open source and open hardware FIDO2 security keys (check for the "Nitrokey FIDO2" and "Nitrokey 3" related repositories).
FIDO2 CTAP2 Javacard Applet.
A privacy-focused Java Card U2F Authenticator based on ledger-u2f-javacard (More recent fork of Ledger).
FIDO2 Postman clients to easily test your FIDO2 API endpoints.
A simple website for previewing WebAuthn attestations and assertions.
A webauthn device and browser stress tester that can identify flaws in implementations and has already found bugs in Firefox, Safari, Android and more.
A GO package to automate testing of a relying party WebAuthn server implementation without requiring a browser or an actual authenticator.
A user-friendly web UI to explore the FIDO Metadata Service repository, which contains detailed characteristics and attestation certificates of authenticators registered to the FIDO Alliance.
A web page (no server) to test WebAuthn operations with configurable parameters, and view/parse responses.
A simple website to test different passkeys / WebAuthn server settings and client responses.
Java library and CLI utility for working with CTAP devices over USBHID and NFC
CLI to verify Passkey Related Origin Request .well-known/webauthn configuration, shows label counts and origin matching.
Chrome extension for recording and analyzing WebAuthn API (navigator.credentials) calls.
An engineer-friendly web UI for testing passkey and recovery signature(FIDO U2F-P256) with customizable parameters and visualization tools.
A right place to find most recent & original FIDO specifications.
Client to Authenticator protocol v2.1
Webauthn draft
A CBOR specification page with most recent updates and libraries for using CBOR in various programming languages.
Credential Exchange Protocol (CXP) & Credential Exchange Format (CXF), working drafts
In depth article grinding through WebAuthn API, and how to use it.
A greate guide on starting with passkeys.
Great WebAuthn beginners guide by Suby Raman.
How an identifier-first flow helps migrate users towards passwordless. Integrates Yubico's java-webauthn-server with AWS Lambda and AWS Cognito. Includes example web and iOS clients. See Reference Architecture.
Yubico java discoverable credentials workshop.
An awesome WebAuthn introduction by Eiji Kitamura @ Google.
A definitive guide on good FIDO UI/UX.
Complete Next.js WebAuthn walkthrough covering registration and authentication flows.
Great blog for those who wish to go in-depth with WebAuthn.
A fantastic introduction to WebAuthn by folks at Auth0.
JP: 技術メモとか料理ネタとか.
Probably the best CredManAPI guide.
JP: セキュリティ, Android, Cloud Nativeについてまとめるブログです.
認証,認可,FIDO,CTAP,NFC,BLE,c,c++,c#,Rust,ねこのげぼく.
Yahoo! JAPAN FIDO2 サーバーの仕組みに関するブログ.
WebAuthn API と基本的な FIDO 概念の概要.
北村さん、パスワードレスの世界づくりについて語る.
This article shows how Fido2 WebAuthn could be used as 2FA and integrated into an ASP.NET Core Identity application.
How to stay safe online and prevent phishing with FIDO2, WebAuthn and security keys. (Less technical but a very usefull article).
A woundeful tech article about attestations.
FIDO2 keys on Linux and for cloud services.
A master's thesis comparing WebAuthn with other multi-factor authentication methods, such as HOTP, TOTP or U2F.
Nice tutorial on how to use FIDO2 to authenticate SSH sessions. As short as possible, but as detailed as necessary to understood all important topics (e.g. resident vs. non-resident keys).
A good overview with many detailed links to dig deeper if interested.
A official guide to make your security keys Microsoft Entra compatible.
Introduction to WebAuthn Slide deck from 2019 talks.
Great guide for those who want to add passkey support to their Android app.
A library of slides by Yuriy Ackermann and WebAuthn Works in English and Russian.
コミックマーケット95で頒布した同人誌「Getting started with WebAuthn」の電子版(PDF)です.
A book by Dmitry Chestnykh @dchest about authentication on web and mobile. Talks in depth about correct password authenticatoin, and additionally introduces to FIDO2/Webauthn.
Anti-phishing passkeys demos for instant messaging apps
Awesome webauthn logos by Adam Powers.
A guide for those who have CTAP2.0 authenticator, and they want to migrate to CTAP2.1
A 2-sided PDF explaining all relevant objects, concepts and ressources to implement passkeys.
WebAuthn API spec official explainers and wiki
Info page that shows current data about passkey-readiness of operating systems and browsers
SSH client that runs in the browser and implements WebAuthn based SSH authentication. WebAuthn authentication is implemented by implementing OpenSSH's [email protected] key type in go and compiling it to WebAssembly.
If you have passed conformance tools, send me a DM or a tweet @herrjemand with a screenshot of passing the tests.
VoltAgent/awesome-openclaw-skills
The awesome collection of OpenClaw skills. 5,400+ skills filtered and categorized from the official OpenClaw Skills Registry.🦞
awesome-dsh-plugin/awesome-dsh-plugin
A curated list of plugins for DeepSeek Harness (dsh) · DeepSeek Harness 插件精选列表
Kristories/awesome-guidelines
Programming style, best practices, and coding conventions.
sindresorhus/awesome
😎 Awesome lists about all kinds of interesting topics [NOTE: Pull requests are temporarily disabled until I have a chance to catch up with the existing ones]
ai-boost/awesome-prompts
Curated list of chatgpt prompts from the top-rated GPTs in the GPTs Store. Prompt Engineering, prompt attack & prompt protect. Advanced Prompt Engineering papers.
matiassingers/awesome-readme
A curated list of awesome READMEs