WebAuthn Level 3 Is Final: What Passkey Implementers Must Change

WebAuthn Level 3 became a W3C Recommendation on 25 August 2026, replacing Level 2 and formalizing browser features including passkey autofill, JSON conversion helpers, conditional credential creation, the Signal API, and Related Origin Requests. Although existing passkeys remain compatible, servers may need changes because AAGUIDs are no longer zeroed for “none” attestation and should not be treated as attestation proof, while Backup Eligibility and Backup State flags should be stored and updated to distinguish synced from device-bound credentials. Implementers should validate `topOrigin` for cross-origin iframe flows, stop using deprecated features such as the uvm extension and token binding, prefer recommended cryptographic algorithms, and increase ceremony and challenge timeouts to around five minutes. The recommendation also encourages capability detection through `getClientCapabilities()` rather than browser sniffing, synchronization of password-manager credential lists through the Signal API, and use of Related Origin Requests to share passkeys across approved brand domains. For enterprise applications, passkeys remain an application-level authentication mechanism, while organizational access policies are generally managed through identity providers using SSO.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.