Signal / 022 — WebAuthn Level 3 turns passkeys into web infrastructure

Explainer: Passkeys are no longer just a product feature competing for space in a login screen. The standard underneath them has reached a new milestone.

On August 25, 2026, the World Wide Web Consortium published Web Authentication Level 3 as a W3C Recommendation. WebAuthn lets a site request public-key credentials from an authenticator—such as a phone, security key, or platform credential manager—without giving the site a reusable password secret.

The important shift

A WebAuthn credential is scoped to a relying party. In plain language, the credential created for one legitimate domain is not a password that can be typed into a convincing fake domain. Authentication uses a private key held by the authenticator and a public key stored by the service. That architecture is why passkeys can be resistant to the familiar “enter your password here” phishing trap.

Level 3 gives browser makers, operating systems, password managers, and web developers a stable shared specification for the next round of implementation work. A Recommendation does not mean every feature appears everywhere on the same day, nor does it erase recovery problems. Users still need a sane path when a device is lost, an account changes ecosystems, or a credential provider becomes unavailable.

Built for the edge cases

Opinion: The real test is no longer whether passkeys work in the happy path. It is whether account recovery, device migration, and shared-device use work without quietly falling back to a weaker password flow. Developers should test those exits as seriously as the front door.

The password is not dead today. But the web now has a stronger default route available—and fewer technical reasons to keep shipping the old one forever.

AI-assisted summary: This explainer was drafted with AI assistance and reviewed against W3C’s official announcement and specification history.