FIDO/WebAuthn is a phishing-resistant authentication standard that replaces reusable passwords with cryptographic login proof. A user’s device or security key stores a private key, while the service keeps the matching public key. During sign-in, the browser and authenticator sign a challenge tied to the real website origin, so the credential cannot be copied and replayed on a fake page.
This matters because many attacks begin with a lookalike login portal or urgent message that tricks people into entering a password or one-time code. FIDO/WebAuthn makes those traps far less useful: even if a victim visits a cloned site, the authenticator will not produce a valid response for the attacker’s domain. Defenders use it to protect email, admin panels, and other high-value accounts, especially where credential theft and account takeover are likely.