# From U2F to passkeys

DevFeed: [From U2F to passkeys](<https://devfeed.tech/articles/from-u2f-to-passkeys-36608.md>)

Original publisher: [Read original article](<http://www.imperialviolet.org/2023/07/23/u2f-to-passkeys.html>)

Author: Adam Langley

Published: 2023-07-23T00:00:00Z

Content type: article

Language: en

Sources: [ImperialViolet](<https://devfeed.tech/sources/imperialviolet.md>)

Topics: [Passkeys](<https://devfeed.tech/topics/passkeys.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [Protocol (disambiguation)](<https://devfeed.tech/topics/protocol.md>), [Security](<https://devfeed.tech/topics/security.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [digital-signatures](<https://devfeed.tech/tags/digital-signatures.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [private-key](<https://devfeed.tech/tags/private-key.md>), [protocol](<https://devfeed.tech/tags/protocol.md>)

## AI overview

This article gives a chronological account of how standards developed from U2F into passkeys. It explains U2F's security-key and JavaScript API standards, the risks of bearer tokens such as passwords and cookies, and how digital signatures can authenticate users without disclosing a private key.

## Source excerpt

(This post is nearing 8 000 words. If you want to throw it onto an ereader there's an EPUB version too.) Introduction Over more than a decade, a handful of standards have developed into passkeys--a plausible replacement for passwords. They picked up a lot of complexity on the way, and this post tries to give a chronological account of the development of the core of these technologies. Nothing here is secret; it's all described in various published standards. However, it can be challenging to read these standards and understand how it's meant to fit together. The beginning: U2F U2F stands for "Universal Second Factor". It was a pair of standards, one for computers to talk to small removable devices called security keys, and the second a JavaScript API for websites to use them. The first standard of the pair is also called the Client to Authenticator Protocol (CTAP1), and when the term "U2F" is used in isolation, it usually refers to that. The JavaScript API, now obsolete, was generally referred to as the "U2F API". The goal of U2F was to eliminate "bearer tokens" in user authentication. A "bearer token" is a term of art in authentication that refers to any secret that is passed around to prove identity. A password is the most common example of such a secret. It's a bearer token because you prove who you are by disclosing it, on the assumption that nobody else knows the secret. Passwords are not the only bearer tokens involved in computer security by a long way--the infamous cookies that all web users are constantly bothered about are another example. But U2F was focused on user authentication, while cookies identify computers, so U2F was primarily trying to augment passwords. The problem with bearer tokens is that to use them, you have to disclose them. And knowledge of the token is how you prove your identity. So every time you prove your identity, you are handing another entity the power to impersonate you. Hopefully, the other entity is the intended counterparty and