W3C publishes Web Authentication Level 3 as a web standard
The latest version of the Web Authentication standard provides a framework for websites to use public key credentials and authenticators for stronger and more secure user authentication.
The World Wide Web Consortium (W3C) has published Web Authentication: An API for accessing Public Key Credentials Level 3 as a W3C Recommendation, marking it as an official web standard.
Web Authentication, commonly known as WebAuthn, provides websites with a way to verify users without relying solely on traditional passwords. Instead, users can authenticate using a device or authenticator, such as a smartphone, security key or built-in biometric authentication.
The system works by creating a pair of cryptographic keys. The private key remains securely stored on the user’s authenticator, while the website receives the corresponding public key. When the user logs in, the authenticator can prove that the user has access to the private key without sending the key itself to the website.
WebAuthn credentials are also linked to a specific website or service. This helps reduce the risk of phishing, as credentials created for one website cannot simply be used to authenticate on another. The specification also requires user consent before authentication operations are performed, while browsers act as intermediaries between websites and authenticators to help protect user privacy.
Level 3 succeeds Web Authentication Level 2. With its publication as a W3C Recommendation, the specification represents the latest stable version of the standard, while future features and developments will be considered as part of Web Authentication Level 4.
