What is an Authenticator in WebAuthn?

What is an Authenticator?#

An authenticator is a cryptographically backed device responsible for creating and securely storing WebAuthn user credentials for an application. Here are its core functionalities:

• Creates public-private-key pairs in WebAuthn / passkey authentication.
• Manages the private key and uses them for signing authentication requests.
• Comes in two main types: platform authenticator and roaming authenticator.
• Uses biometrics, PINs, or other methods for user authentication.

Key Takeaways#

---

Understanding Authenticators in Depth#

Authenticators, at their core, offer a shield of security to web and native applications, ensuring the right user accesses the right data. Let's break down the types:

Platform Authenticator (Internal Authenticator):#

• Bound to Specific Devices: Each major tech company has its version: Apple’s Touch ID and Face ID, Microsoft’s Windows Hello, and Google’s Android biometric features.
• Trusted Platform Module (TPM): A built-in cryptographic element, TPM manages public and private keys. It typically uses a device's biometric capability, such as face or fingerprint scanners, for authenticating users. However, other methods like PINs in Windows Hello or lock-screen patterns in Android smartphones are also prevalent.

Roaming Authenticators (Cross-platform Authenticators):#

• Portable and Versatile: These are external devices that can be used with different client devices, like laptops or smartphones. They can connect using USB, NFC, or Bluetooth.
• Varieties: The most common form are hardware security keys, such as YubiKeys. Some even have fingerprint scanners, while others may require a simple button press.

---

Authenticator FAQs#

What is the primary function of an authenticator?#

An authenticator is a cryptographically supported device used for creating and securely storing user credentials for an application. Its primary function is to create public-private-key pairs, manage the private key and utilize it for signing authentication requests.

How do platform authenticators differ from roaming authenticators?#

Platform authenticators are device-specific, like Apple's Touch ID / Face ID, and are bound to a particular device. In contrast, roaming authenticators are external, portable devices, such as security keys, that can be used across different client devices.

Can roaming authenticators be used for sharing passkeys?#

Roaming authenticators should not be mistaken for passkey sharing capabilities like QR code scanning, Bluetooth, or AirDrop. They serve different purposes in the realm of user authentication.

About Corbado

Corbado is the Passkey Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: which devices, OS versions, browsers and credential managers support passkeys, why enrollments don't turn into logins, where the WebAuthn flow fails and when an OS / browser update silently breaks login, all without replacing Okta, Auth0, Ping, Cognito or your in-house IDP. Two products: Corbado Observe layers observability for passkeys and any other login method. Corbado Connect adds managed passkeys with analytics built in (alongside your IDP). VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →