WebAuthn — from credential.create() to synced passkeys.
How the web platform absorbed FIDO — from the W3C Credential Management API in 2016 to ubiquitous platform-synced passkeys in 2024 — and what each WebAuthn level added along the way.
Timeline
W3C Credential Management API first draft
The first public working draft of the browser API for storing and retrieving credentials. WebAuthn is later built on top of it.
WebAuthn First Public Working Draft
The W3C Web Authentication WG publishes the first public working draft (May 2016).
WebAuthn Level 1 Candidate Recommendation
Candidate Recommendation (March 2018). CTAP2 is developed in parallel at the FIDO Alliance; the pairing is branded "FIDO2".
WebAuthn Level 1 Recommendation
Stable W3C Recommendation (March 2019). Chrome, Edge, Firefox and Safari ship WebAuthn support.
Conditional UI first proposals
Discussion of autofill-style passkey UX begins. The path to passkey ubiquity opens.
WebAuthn Level 2 published
W3C Recommendation (April 2021). Adds residentKey semantics and the credProps and large-blob extensions. Foundation for passkeys.
Apple, Google, Microsoft announce passkeys
Apple, Google and Microsoft commit (May 2022) to platform-synced FIDO credentials. iCloud Keychain and Google Password Manager become passkey vaults.
Cross-device authentication shipping
Hybrid CTAP transport (Bluetooth + tunnel server) lets a phone authenticate a desktop session.
Passkeys at consumer scale
1Password, Dashlane, Bitwarden ship passkey support. Major consumer sites (Google, eBay, Amazon, GitHub) accept passkeys as a primary factor.
WebAuthn Level 3 becomes a W3C Recommendation
Published August 2026 after a January 2026 Candidate Recommendation: conditional mediation, client hints, getClientCapabilities, and the signal API for orphaned credentials.
Per-credential provenance policy
Relying parties begin to distinguish attested-hardware passkeys from synced passkeys at policy time. AmbiSecure validation server records AAGUID + transport + attestation per credential.
Continue exploring.
How do you build against this evolution?
If your roadmap touches any of these milestones, our engineering team can map the standards posture to a deployable architecture.