FIDO means Fast Identity Online: a family of authentication standards built around public-key cryptography. In everyday use, FIDO is most visible through passkeys, which let you sign in by approving a request with your device’s PIN, password, or biometric. You do not need a separate security key; a phone or computer can provide the authenticator.
What is FIDO (Fast Identity Online)?
FIDO is the broader authentication standards effort developed by the FIDO Alliance. Rather than asking a service to verify a shared password, FIDO authentication uses a cryptographic credential created for that service. During registration, an authenticator creates the credential: the service stores its public key, while the authenticator keeps the private-key operation. At sign-in, the service sends a challenge and the authenticator proves possession of the credential.
As an Amazon Associate I earn from qualifying purchases.
Because the credential is specific to the service, a fake site cannot normally use it to authenticate to the real one. FIDO Alliance describes its standards as providing phishing-resistant authentication. That design is an important protection, but account security also depends on how a service implements authentication and handles account recovery.
How are FIDO, FIDO2, WebAuthn, CTAP, and passkeys related?
| Term | What it means |
|---|---|
| FIDO | The broader standards effort and family of specifications, including U2F, UAF, and CTAP. FIDO Alliance specifications |
| FIDO2 | The combination of WebAuthn and CTAP. FIDO Alliance FIDO2 overview |
| WebAuthn | The W3C web API that websites use to create and use public-key credentials. |
| CTAP | The FIDO protocol that lets a platform communicate with an external authenticator, such as a security key. |
| Passkeys | Credentials based on FIDO standards. They use the same FIDO2 standards—WebAuthn and CTAP—rather than a separate replacement standard. FIDO Alliance passkeys overview |
| CTAP1 and UAF | CTAP1 is the FIDO2-context name for the earlier U2F protocol. UAF is another FIDO specification family, not another name for FIDO2. FIDO Alliance specifications |
What does signing in with a passkey look like?
- Register: The service and authenticator establish a credential for that service. The service saves the public key, not the corresponding private-key operation.
- Respond to a sign-in request: The service sends a challenge. Your authenticator uses the credential to produce a response.
- Approve locally: You unlock or approve with the method available on your device, such as a PIN, device password, or biometric.
- Verify: The service checks the response using the public key associated with your account.
When a biometric is used, the check happens locally: the service receives an indication that verification succeeded, not the biometric information itself. FIDO Alliance passkeys overview
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Are passkeys synced or tied to one device?
FIDO distinguishes two arrangements. A synced passkey is synchronized among a user’s devices through a service. A device-bound passkey stays on one device; security keys and devices with secure hardware are examples. FIDO Alliance passkeys overview
Neither arrangement is best for everyone. Synced credentials can make it easier to use a passkey on multiple devices, while a device-bound credential keeps it tied to a particular device or key. Consider portability, who controls the device, your organization’s rules, and how you would recover access if it were lost. FIDO standards do not prescribe one universal recovery method.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Do you need a hardware security key to use FIDO?
No. A phone or computer can use a built-in, or platform, authenticator with its local PIN or biometric. An external, or roaming, authenticator can be a hardware security key or a phone used with another device. CTAP supports USB, NFC, and Bluetooth Low Energy for communication with external authenticators. FIDO Alliance specifications FIDO Alliance FIDO2 overview
A security key is one optional way to carry a device-bound credential between supported devices and services. Before choosing one, check whether the service accepts security keys, which interfaces the key supports, and whether those interfaces work with your devices. Standards define interoperable protocols, but they do not guarantee that every key, browser, operating system, and account will work together. FIDO Alliance FIDO2 overview
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What is the current status of the FIDO standards?
Standards have versions and publication statuses, so a version number alone does not tell you whether it is a final recommendation. As reported by the FIDO Alliance, WebAuthn Level 3 became a W3C Recommendation on 25 August 2026; the Alliance announced this on 31 August 2026. FIDO Alliance announcement
The FIDO specifications index lists CTAP 2.2 as a Proposed Standard, dated 14 July 2025. Separately, the FIDO server certification page identifies an active server requirements profile referencing WebAuthn Level 3 and CTAP 2.3. An active certification profile does not, by itself, mean that a specification has the same publication status as a W3C Recommendation or a Proposed Standard. FIDO Alliance specifications index FIDO Alliance server certification
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
