FIDO — from FIDO 1.0 to passkeys.
The path from FIDO Universal Second Factor to phishing-resistant, hardware-bound, multi-device passkeys — with the standards milestones, deployment shifts, and ecosystem turning points along the way.
Timeline
FIDO Alliance formed
PayPal, Lenovo, Nok Nok Labs, Validity Sensors, Infineon, and Agnitio found the FIDO Alliance to standardise a passwordless second factor.
FIDO 1.0 published (UAF + U2F)
Universal Authentication Framework and Universal Second Factor specifications released. U2F adopted by Google for Gmail; second-factor hardware keys begin to ship.
Google U2F Security Key rollout
Google rolls U2F Security Keys out across its workforce; its two-year deployment study (Financial Cryptography 2016) reports higher security and user satisfaction than OTP-era second factors.
FIDO2 / WebAuthn Level 1 (W3C Candidate Recommendation)
WebAuthn reaches W3C Candidate Recommendation; CTAP2 defines the client-to-authenticator protocol. Together they are branded "FIDO2"; U2F lives on as CTAP1.
WebAuthn Level 1 becomes a W3C Recommendation
Chrome, Edge, Firefox and Safari ship WebAuthn support. Hardware keys with FIDO2 attestation become the gold standard for high-assurance enterprise MFA.
CTAP2.1 work begins; biometric authenticators arrive
On-card and on-device biometric verification (BIO-FIDO) starts shipping. PIN-protected resident credentials become viable for consumer-grade products.
WebAuthn Level 2, CTAP 2.1 and FIDO MDS3 published
WebAuthn Level 2 (W3C Recommendation, April 2021) adds residentKey semantics and the credProps and large-blob extensions. CTAP 2.1 (June) makes credential management and alwaysUv first-class, and the FIDO Metadata Service v3 (May) BLOB becomes the canonical attestation-trust source.
Passkeys announced (Apple / Google / Microsoft)
Apple, Google and Microsoft commit (May 2022) to multi-device, synced FIDO credentials — the consumer pivot from hardware-only keys to platform-synced credentials.
Enterprise migration from password+OTP
Phishing-resistant MFA mandates (OMB M-22-09) and NIST SP 800-63-4 (final July 2025: a phishing-resistant authenticator at AAL3, a phishing-resistant option offered at AAL2) push enterprise IdPs to ship synced + hardware-key options side by side.
CTAP 2.2 published
The July 2025 Proposed Standard specifies the hybrid transports (QR-initiated and state-assisted) behind cross-device passkey sign-in.
WebAuthn Level 3 becomes a W3C Recommendation
Published August 2026: conditional mediation, client hints, getClientCapabilities, and the signal API for removing orphaned credentials.
Hardware-bound + synced converge
Validation servers begin recording per-credential provenance (synced vs. attested-hardware-bound) so relying parties can apply policy. AmbiSecure validation server ships per-tenant policy on AAGUID + transport.
Continue exploring.
How do you build against this evolution?
If your roadmap touches any of these milestones, our engineering team can map the standards posture to a deployable architecture.