Authenticator Support Matrix

A live, filterable reference matrix of WebAuthn / FIDO2 authenticators — platform providers like iCloud Keychain, Google Password Manager and Windows Hello, password managers like 1Password and Bitwarden, and roaming hardware keys like YubiKey and Titan — mapped against the features that actually shape a passkey integration:

• Cross-device sync
• Discoverable (resident) credentials
• User verification
• largeBlob extension
• PRF extension
• credProtect
• Conditional mediation (autofill UI)
• Hybrid transport (cross-device / caBLE)
• Enterprise attestation

The data lives in one community-maintainable JSON file; the viewer is a single self-contained static HTML page with no build step, no framework, and no network or CDN dependencies.

Built and maintained by the team behind passkeywebauthn.com — the Passkey & WebAuthn Engineering Hub.

Why this exists

"Does this authenticator support PRF?" rarely has a one-word answer — it depends on the authenticator, the operating system, and the browser all at once. This project collects those answers in a structured, reviewable dataset so you can filter by type or platform, read the caveats, and link colleagues to a specific row instead of trading screenshots.

For the concepts behind the columns, see the guide on platform vs. roaming authenticator trade-offs and discoverable vs. server-side credentials.

Quick start

The viewer fetches data/authenticators.json, so it must be served over HTTP — opening index.html from disk will not work.

# Python (no install)
python3 -m http.server 8080

# or via npm (uses npx http-server, no saved dependency)
npm run serve

Then open the local matrix in your browser.

Validate the data

A zero-dependency validator checks the dataset against its JSON Schema and verifies referential integrity (every per-authenticator feature key references a declared feature, all values are in the allowed enum, ids are unique, and no declared feature is left unrated):

node scripts/validate.mjs
# or
npm run validate

It exits 0 on success and non-zero with a list of problems otherwise. The same check runs in CI on every push and pull request via .github/workflows/validate.yml.

Project structure

authenticator-support-matrix/
├── index.html                     # Self-contained viewer (inline CSS + vanilla JS)
├── data/
│   ├── authenticators.json        # The dataset (edit this)
│   └── authenticators.schema.json # JSON Schema for the dataset
├── scripts/
│   └── validate.mjs               # Zero-dependency validator
├── package.json
├── CONTRIBUTING.md
├── LICENSE
└── .github/workflows/validate.yml

The dataset

data/authenticators.json has three top-level keys — meta, features, and authenticators. Each authenticator carries an id, name, vendor, type (platform | roaming), platforms, firstAvailable, notes, and a features map whose values are one of yes / no / partial / unknown (each with an optional note). The full shape is documented in data/authenticators.schema.json and in CONTRIBUTING.md.

A note on accuracy

WebAuthn feature support is a moving target and depends on the specific authenticator + OS + browser combination. Values here reflect widely documented behavior as of the dataset's lastUpdated; where a capability is genuinely unclear it is marked partial or unknown with a note. Always confirm against vendor documentation before making production decisions. Corrections are welcome — see below.

Contributing

Adding or correcting an authenticator is a one-file change plus a validator run. See CONTRIBUTING.md for the data model, field rules, and the review process. Please cite a source for any non-obvious change.

Related guides

• Platform vs. roaming authenticator trade-offs
• Choosing authenticator attachment
• Hybrid transport and cross-device passkeys
• Discoverable vs. server-side credentials
• Cryptographic algorithms supported by WebAuthn
• Conditional mediation and autofill UI
• Browser support matrix for conditional mediation

License

MIT © 2026 passkeywebauthn

Related tools

Part of a small set of open-source WebAuthn tools:

• passkey-inspect — decode WebAuthn payloads (attestationObject, authenticatorData, COSE keys) from the CLI or as a library.
• webauthn-ceremony-inspector — a browser DevTools panel that captures and decodes live WebAuthn ceremonies.
• passkey-fixture-generator — deterministic, valid registration/authentication test fixtures for backend verification.
• rp-id-doctor — validate your rpId, origins, and .well-known/webauthn configuration in CI.
• passkey-fallback-flow-kit — framework-agnostic UI building blocks for passkey fallback UX.