WebAuthn is a web authentication standard based on public-key cryptography. Passkeys are FIDO credentials that enable sign-in without entering a conventional password. The available Joomla journey depends on its version, plugins and login settings.
How verification works
During registration, the website receives a public key. The private key remains under the control of an authenticator or credential provider. At sign-in, the authenticator signs a server challenge. A fingerprint or PIN can locally unlock key use without sending the fingerprint to the website.
Browser and server checks bind authentication to the website, helping resist phishing. Session and device protection still matter. Not every WebAuthn deployment represents the same MFA flow.
Storage and recovery
Passkeys can be device-bound or synced through a provider. This affects transfer to a new device and account recovery. A hardware security key can provide a separate sign-in method when supported.
Joomla considerations
Before using WebAuthn in Joomla, check HTTPS, browser and device support, and the particular plugin. Domain changes require attention to registered credentials. Test the new Joomla sign-in and backup recovery before disabling an earlier method.
Conclusion
WebAuthn ties verification to a key and website. Reliable adoption includes compatibility checks and a lost-device recovery plan.