W3C proposes Web Authentication Level 3 as a web standard

The World Wide Web Consortium (W3C) announced on 20 July 2026 that it had proposed advancing Web Authentication: An API for accessing Public Key Credentials Level 3 to W3C Recommendation status.

The specification, commonly known as WebAuthn Level 3, was published as a Candidate Recommendation Snapshot by the Web Authentication Working Group on 26 May 2026.

WebAuthn allows websites to authenticate users through public key credentials instead of relying only on passwords. These credentials may be stored in a device, a password manager or a physical security key.

When a user signs in, the device provides the website with cryptographic proof that the user has approved the action. The private credential remains with the user’s device or authenticator and is not shared with the website.

Each credential is linked to a specific website or service. This helps prevent phishing because a credential created for one website should not work on a fraudulent site using a different domain.

The specification also defines how browsers communicate with authenticators and how authenticators confirm their properties to websites. It requires user consent before an authentication operation can take place.

The proposal means W3C considers the specification sufficiently mature to become an official Recommendation. It is not yet the final approval itself, but represents the last stage before adoption as a completed W3C web standard.

What does this mean?

For users, the standard supports signing in with a fingerprint, face scan, device PIN or security key instead of entering a password. It provides the technical basis for passkeys and other phishing-resistant login methods.

For websites and software developers, Recommendation status would provide a stable common standard for implementing these sign-in methods across browsers, devices and services. This should improve compatibility and reduce dependence on passwords, which can be stolen, reused or exposed in data breaches.