Standards may not be exciting, but they're essential. The convergence of WebAuthn Level 3 and NIST SP 800-63-4 in 2025 creates a clear path for organizations implementing passwordless authentication. For the first time, both technical capabilities and regulatory acceptance are aligned.
WebAuthn Level 3: What's New
The W3C's WebAuthn Level 3 specification, with its Working Draft published in January 2025, represents the most significant update to the WebAuthn standard since its initial release. The specification enhances the API for creating and using passkeys with several important improvements.
Cross-Device Authentication Improvements
WebAuthn Level 3 refines the cross-device authentication protocol (caBLE), making it more reliable when using a phone to authenticate on a computer. The improvements include:
- More efficient Bluetooth Low Energy (BLE) discovery
- Better handling of network transitions
- Reduced latency for QR code-based pairing
- Improved error handling and user feedback
Enterprise Extensions
New extensions support enterprise deployment scenarios:
enterpriseAttestation: Allows organizations to require device attestation that identifies the authenticator vendor and model, important for compliance in regulated industries.largeBlobimprovements: Better support for storing additional data with credentials, enabling advanced use cases like certificate storage.- Enhanced relying party identification: Improved mechanisms for binding credentials to specific organizational contexts.
Conditional UI (Autofill)
WebAuthn Level 3 standardizes conditional UI, also known as passkey autofill. This allows browsers to suggest passkeys in the same way they suggest saved passwords, reducing friction and improving discoverability:
- Users see passkey options alongside password autofill
- No explicit user action required to initiate passkey authentication
- Seamless fallback to password if passkey isn't available
Signal API
A new Signal API enables relying parties to inform authenticators about credential state:
- Marking credentials as deleted when accounts are closed
- Updating credential metadata
- Synchronizing state between relying party and authenticator
NIST SP 800-63-4: Passkeys Get Official Recognition
The National Institute of Standards and Technology's updated Digital Identity Guidelines (SP 800-63-4) provides crucial regulatory backing for passkey adoption. The final version, expected on July 31, 2025, includes several important determinations.
Syncable Authenticators Achieve AAL2
Perhaps the most significant development is NIST's formal recognition that passkeys (termed "syncable authenticators") can achieve Authenticator Assurance Level 2 (AAL2). This is crucial for enterprise and government use because:
- Many federal systems require AAL2 for access to sensitive resources
- NIST guidelines influence private sector compliance frameworks
- Previous uncertainty about syncable credentials deterred adoption
Updated Risk Assessment Framework
The new guidelines provide updated guidance on risk assessment for authentication, acknowledging that:
- Phishing resistance is a significant security property that can offset other risks
- The practical security of synchronized credentials depends on the security of the sync mechanism
- Device binding requirements can be satisfied through different technical approaches
Implementation Flexibility
NIST's updated guidelines provide more flexibility in how organizations implement multi-factor authentication:
- Biometric authentication can serve as an authentication factor when properly implemented
- Device characteristics can contribute to authentication assurance
- Risk-based approaches can adjust authentication requirements dynamically
What This Means for Implementation
Organizations implementing passwordless authentication should consider these implications:
Technical Implementation
WebAuthn Level 3 capabilities require updated libraries and potentially browser version requirements. Key considerations include:
- Library Updates: Ensure your WebAuthn libraries support Level 3 features, particularly if you need enterprise extensions.
- Fallback Strategy: Not all browsers immediately support new features. Plan graceful degradation for older clients.
- Testing: Cross-device and conditional UI features require testing across multiple device and browser combinations.
Compliance Planning
With NIST's endorsement of syncable authenticators for AAL2:
- Update Risk Assessments: Organizations can now include passkeys in AAL2-compliant authentication flows.
- Document Decisions: Maintain records of how your passkey implementation satisfies regulatory requirements.
- Monitor Guidance: Final NIST guidelines may include additional requirements or clarifications.
User Experience
New capabilities enable better user experiences:
- Leverage Conditional UI: Implement passkey autofill to make authentication seamless.
- Cross-Device Flows: Test and optimize the experience for users authenticating on one device with credentials on another.
- Clear Communication: Help users understand when they're using passkeys versus passwords.
Industry Impact
These standards are accelerating passwordless adoption across sectors:
Financial Services
Banks and payment providers, previously cautious about syncable credentials, now have regulatory clarity. Expect rapid adoption of passkeys for consumer banking applications.
Healthcare
HIPAA-covered entities can now more confidently implement passkeys, knowing they satisfy authentication requirements when properly deployed.
Government
Federal agencies and their contractors have clear guidance for including passkeys in their authentication architectures.
Enterprise
Organizations with compliance obligations now have the regulatory foundation to justify passwordless investments.
Looking Ahead
The standards landscape continues to evolve:
- Credential Exchange: Standards for moving credentials between platforms and password managers are maturing.
- Identity Verification: Work is underway to connect passkey authentication with stronger identity proofing.
- Decentralized Identity: Integration between WebAuthn and emerging decentralized identity standards is progressing.
- IoT Authentication: Extensions for authenticating to devices beyond traditional computers and phones are in development.
Conclusion
The convergence of WebAuthn Level 3 and NIST SP 800-63-4 marks a maturation point for passwordless authentication. Technical capabilities are robust. Regulatory acceptance is clear. The remaining barriers are organizational and operational, not technological or regulatory.
For organizations planning authentication modernization, these standards provide a solid foundation. For those hesitating due to compliance concerns, the uncertainty has largely been resolved. The path to passwordless is now well-marked, well-supported, and ready to travel.