The World Wide Web Consortium (W3C) has published the Web Authentication (WebAuthn) Level 3 specification as a W3C Recommendation, meaning that it now a completed standard. While remaining compatible with the Level 1 and Level 2 standards, this third version adds additional features, in part, to enable improvements to user experiences with passkeys.

Meanwhile, between the publication of Level 2 in 2021 and Level 3 and 2026, the FIDO Alliance published versions 2.2 and 2.3 of the FIDO2 Client to Authenticator Protocol (CTAP) specification, which this specification can be used with. See my post about CTAP 2.3.

I highly recommend Tim Cappalli’s detailed summary of the changes in Level 3 of WebAuthn.

The one thing I’d add to Tim’s description of what’s next for WebAuthn is:

• Raw Signing Extension: PR #2078 creates a mechanism for signing arbitrary data using a key associated with but different from a WebAuthn credential key pair.

The raw signing extension is used the wwWallet cloud-based digital identity wallet by the SIROS Foundation.

Congratulations to all who contributed to reaching this important milestone!