The FIDO Alliance is an open industry association that develops standards for signing in without passwords. Its specifications, known as FIDO and FIDO2, underpin passkeys, the sign-in method now built into the main phone and computer operating systems and browsers. Banks, payment companies and online merchants use FIDO standards to authenticate customers, approve payments and reduce account takeover. FIDO stands for Fast IDentity Online.
The alliance writes specifications, certifies products and promotes adoption; it does not run a login service or hold user credentials. Its work sits beside other standards bodies: the World Wide Web Consortium (W3C) publishes the browser interface, Web Authentication (WebAuthn), that FIDO2 relies on, while EMVCo handles card payment standards. Since 2026 the alliance has also hosted standards work on authentication for AI agents that pay on behalf of users.
FIDO Alliance in plain terms
A password is like a secret word shouted through a door: anyone who overhears it, or tricks you into saying it at the wrong door, can use it later. FIDO replaces the secret word with something closer to a lock and key. Your phone or laptop keeps a private key that never leaves the device, and the website keeps only a matching lock.
When you sign in, the website sends a fresh challenge, and your device answers it after you unlock the device with your fingerprint, face or PIN. The answer only works for that one website, so a fake look-alike site gets nothing useful. There is no shared secret on the website for hackers to steal in bulk. The alliance's job is to make sure every phone, browser and website follows the same rules, so a key made on one device is accepted everywhere that supports it.
History
The alliance was launched publicly in February 2013 by a small group of companies that included PayPal, Lenovo and Nok Nok Labs. It published its first specifications, Universal Authentication Framework (UAF) for passwordless login and Universal 2nd Factor (U2F) for security keys, in December 2014. Large technology firms joined in the following years.
FIDO2 combined the alliance's Client to Authenticator Protocol (CTAP) with WebAuthn, which the W3C made an official Recommendation in March 2019. In May 2022 Apple, Google and Microsoft jointly committed to extend FIDO support so that credentials could sync across a user's devices, the step that turned FIDO2 credentials into consumer passkeys.
How FIDO authentication works
FIDO uses public-key cryptography. At registration the user's device, called an authenticator, creates a key pair for that one website. The private key stays on the device or in the platform's encrypted keychain, and the site stores only the public key. At login the site sends a random challenge, and the device returns a digital signature that the site checks against the stored public key.
- Local user verification. A fingerprint, face scan or PIN unlocks the key on the device; the biometric data never goes to the website.
- Origin binding. Each key works only for the site that created it, which defeats most phishing pages.
- No shared secrets. A breach of the website's database exposes public keys, which cannot be used to sign in.
Because one action combines something the user has with something the user is or knows, FIDO counts as multi-factor authentication and can satisfy strong customer authentication rules in Europe. It is a stronger alternative to the one-time password sent by text message and to knowledge-based authentication.
Structure and programmes
Members range from board-level companies, including major technology platforms, card networks and banks, to sponsors, government agencies and associates. Technical working groups draft specifications, which the board approves. The alliance also runs certification programmes for authenticators and servers, a programme for remote identity verification using document and face checks, and FIDO Device Onboard, a standard for securely connecting internet-of-things devices. It complements, rather than replaces, federated identity management systems that pass a login from one service to another.
Agentic payments work
On 28 April 2026 the alliance announced an Agentic Authentication Technical Working Group and said its Payments Technical Working Group, chaired by members from Mastercard and Visa, would take on two contributions: Google's Agent Payments Protocol (AP2), donated together with an updated version, and Mastercard's verifiable intent framework. The aim is open standards that let merchants and banks confirm that an AI agent was authorised by a real user and stayed within the limits of that delegated authority during agentic commerce. The contributions were still being reviewed and developed through the alliance's process as of November 2026.
Criticism and limitations
Synced passkeys depend on the account of the platform that stores them, which ties users to Apple, Google, Microsoft or a password manager, and moving passkeys between ecosystems was slow to arrive. Account recovery still often falls back to email or text codes, which can reopen the weaknesses FIDO removes. Some security specialists prefer device-bound keys for high-risk accounts because synced keys extend trust to the cloud account. Adoption by websites has also been uneven.