w3c/webauthn

View on GitHub

Web Authentication: An API for accessing Public Key Credentials

Stars: 1.5k
Forks: 308
Open beginner issues: 0
Indexed issues: 95
Avg merge: 5h 24m
Merged PRs (30d): 4

Dominant language: Bikeshed
License: No license data
Last GitHub push: Sep 10, 2026
Latest indexed: Sep 20, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

95 open issues indexed

Add a way for RPs to ensure registration of certain authenticator-supported UV methods Open

type:technical

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webauthn#2482 · Opened Sep 18, 2026
Add device binding to cross-device fallback URL extension Open

stat:Discuss subtype:FeatureProposal

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webauthn#2478 · 3 comments · Opened Sep 8, 2026
Credential Backup clarification (note about older authenticators) Open

type:editorial

w3c/webauthn#2477 · 3 comments · 1 assignee · Opened Sep 4, 2026
`cmtgKey` extension should allow returning more than one key to facilitate rotating keys to a new algorithm Open

type:technical

w3c/webauthn#2472 · 2 assignees · Opened Aug 28, 2026
[PQ] SHA-256 usage Open

stat:Discuss type:technical

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webauthn#2471 · 7 comments · Opened Aug 26, 2026
Should a CTAP2 virtual authenticator support CTAP1/U2F? Open

type:technical

w3c/webauthn#2468 · 2 comments · 1 assignee · Opened Aug 18, 2026
Document risks of allowing multiple origins Open

subtype:RP-impl-cons type:editorial

Difficulty 4/5 3-5 days Newbie friendliness 48/100

w3c/webauthn#2466 · 8 comments · 1 reaction · Opened Aug 13, 2026
Hints should not take precendence over transports in an authentication ceremony Open

type:technical

Difficulty 5/5 Over a week Newbie friendliness 30/100

w3c/webauthn#2465 · 1 comment · 1 reaction · Opened Aug 13, 2026
Virtual authenticator add credential command should handle default parameters better Open

type:technical

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

w3c/webauthn#2464 · Opened Aug 7, 2026
Reference in description of `clientDataJSON` in `AuthenticatorAttestationResponse` Open

type:editorial

Difficulty 1/5 1-3 hours Newbie friendliness 76/100

w3c/webauthn#2461 · Opened Aug 4, 2026
Cross-RP batch enrollment of a backup security key Open

stat:Discuss subtype:FeatureProposal

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webauthn#2460 · Opened Aug 3, 2026
Virtual authenticator should clarify what happens when you add a credential with the same { rp id, user id } as an existing credential. Open

type:technical

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webauthn#2459 · 1 comment · Opened Jul 31, 2026
Hint to deprioritize credential providers that hold a credential in excludeCredentials Open

stat:Discuss subtype:FeatureProposal

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webauthn#2458 · Opened Jul 30, 2026
Multiple independent applications on one host Open

stat:Discuss subtype:FeatureProposal

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webauthn#2457 · 2 comments · Opened Jul 29, 2026
[PQ] Add new batch attestation type for Merkle tree certificates Open

type:technical

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webauthn#2456 · 5 comments · 2 reactions · Opened Jul 29, 2026
Virtual authenticator should clarify that ctap2/u2f authenticator cannot have transport=internal (and others). Open

type:technical

Difficulty 3/5 1-2 days Newbie friendliness 55/100

w3c/webauthn#2453 · Opened Jul 27, 2026
Virtual authenticator large blob commands should clarify that the credential must be discoverable Open

type:technical

w3c/webauthn#2452 · 1 assignee · Opened Jul 27, 2026
Virtual authenticator set credential properties and remove credential should clarify that credentialId is base64 url encoded Open

type:technical

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

w3c/webauthn#2450 · Opened Jul 22, 2026
[PQ] Default Algorithems for Authenticators perhaps need updating. Open

type:technical

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webauthn#2448 · 6 comments · Opened Jul 16, 2026
Virtual Authenticator's get credential should specify how the credential object is serialized Open

type:technical

w3c/webauthn#2447 · 1 assignee · Opened Jul 13, 2026
Virtual Authenticator's add credential should probably support more algorithms than ECDSA Open

type:technical

w3c/webauthn#2446 · 1 assignee · Opened Jul 13, 2026
"Invoke the authenticatorMakeCredential operation" step is accidentally indented Open

type:editorial

Difficulty 1/5 Under an hour Newbie friendliness 78/100

w3c/webauthn#2444 · Opened Jul 9, 2026
Extension input processing directions are inconsistent Open

type:technical

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webauthn#2439 · Opened Jul 1, 2026
Consider portable evidence manifests for attestation auditability Open

stat:Discuss subtype:FeatureProposal

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webauthn#2436 · 2 comments · Opened Jun 24, 2026
Discourage bootstrapping new credential provider as part of CREATE call Open

type:technical

Difficulty 5/5 Over a week Newbie friendliness 38/100

w3c/webauthn#2432 · 6 comments · Opened Jun 2, 2026
5.4.3 "the user handle ought not be" -> RFC 2119 Terminology Open

type:editorial

w3c/webauthn#2431 · 5 comments · 1 reaction · 1 assignee · Opened May 25, 2026
remoteClientDataJSON: default allowlist 'none' is not yet defined in Permissions Policy spec Open

type:editorial

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

w3c/webauthn#2430 · 2 comments · Opened May 18, 2026
Missing validation of rpId before Related Origins fetch Open

type:editorial

w3c/webauthn#2422 · 7 comments · 1 reaction · 2 assignees · Opened Apr 29, 2026
[PQ] Post Quantum Crypto and WebAuthn Transition for RP Open

type:technical

w3c/webauthn#2417 · 3 comments · 1 assignee · Opened Apr 22, 2026
Related origin validation should reference the Fetch spec Open

type:technical

w3c/webauthn#2408 · 9 comments · 2 reactions · 1 assignee · Opened Apr 10, 2026
Merge changes made in L3-CR branch into main Open

type:editorial

Difficulty 2/5 1-3 hours Newbie friendliness 55/100

w3c/webauthn#2405 · Opened Apr 1, 2026
Add CTAP2.3 version string for virtual authenticators Open

type:technical

w3c/webauthn#2404 · 1 assignee · Opened Apr 1, 2026
Reconcile hybrid vs PXP throughout the spec Open

type:editorial

w3c/webauthn#2401 · 3 comments · 1 assignee · Opened Mar 26, 2026
Passkeys are phishing-resistant… but what if the device is compromised? Open

stat:Discuss

Difficulty 5/5 Over a week Newbie friendliness 20/100

w3c/webauthn#2396 · 1 comment · Opened Mar 15, 2026
Virtual Authenticator support for the Credential Manager Trust Group Key extentsion Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

w3c/webauthn#2395 · Opened Mar 12, 2026
Extension to detect the use of Hybrid Open

stat:Discuss subtype:FeatureProposal

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webauthn#2394 · Opened Feb 26, 2026
[PQ] Add ML-DSA test vectors Open

type:editorial

w3c/webauthn#2393 · 1 comment · 1 assignee · Opened Feb 26, 2026
Rechartering WebAuthn Open

type:process

w3c/webauthn#2388 · 2 comments · 2 assignees · Opened Feb 6, 2026
Editors, Contributors and Acknowledgements Review Open

type:editorial

w3c/webauthn#2385 · 3 comments · 1 assignee · Opened Jan 28, 2026
Client terminology hints for external authenticator form factors Open

stat:Discuss subtype:FeatureProposal TPAC 2025

w3c/webauthn#2360 · 11 comments · 3 reactions · 1 assignee · Opened Nov 12, 2025
Feature: Allow RP to opt out of certain transports Open

stat:Discuss subtype:FeatureProposal type:technical

w3c/webauthn#2349 · 30 comments · 3 reactions · 1 assignee · Opened Oct 24, 2025
Add hybrid fallback URL extension Open

stat:Discuss subtype:FeatureProposal

w3c/webauthn#2341 · 3 comments · 1 reaction · 1 assignee · Opened Oct 15, 2025
Discovery of migrated credentials Open

stat:Discuss subtype:FeatureProposal TPAC 2025

w3c/webauthn#2340 · 4 comments · 1 assignee · Opened Oct 14, 2025
Add Credential Manager Trust Group Key (CMTG) extension Open

subtype:FeatureProposal TPAC 2025 type:technical

w3c/webauthn#2338 · 10 comments · 1 assignee · Opened Oct 8, 2025
Same PRF regardless of UV? Open

type:technical

w3c/webauthn#2337 · 16 comments · 1 assignee · Opened Oct 8, 2025
WebAuthn requestUserInfo -- easier account creation Open

stat:Discuss subtype:FeatureProposal TPAC 2025 type:technical

w3c/webauthn#2336 · 10 comments · 1 assignee · Opened Oct 1, 2025
document and mitigate fingerprinting and disclosure risk of capabilities and extensions Open

privacy-needs-resolution subtype:FeatureProposal type:technical

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webauthn#2320 · 3 comments · Opened Aug 14, 2025
Add a note about `appid` extension not compatible with related origin requests Open

type:editorial

w3c/webauthn#2312 · 1 comment · 2 reactions · 1 assignee · Opened Jul 10, 2025
Explainer for Level 4 Open

type:explainer

w3c/webauthn#2297 · 5 reactions · 1 assignee · Opened May 28, 2025
Conditional creation incompatible with `uvInitialized` semantics in Chapter 7? Open

type:technical

w3c/webauthn#2295 · 13 comments · 2 reactions · 2 assignees · Opened May 14, 2025

w3c/webauthn

Get new issues in your inbox