Identity and Access
Passkey tools that ship WebAuthn without a science fair (2026)
A 2026 shortlist of WebAuthn libraries and IdPs. Public docs, not a phishing cookbook.
Expertise: Identity and Access · Level: Intermediate · 12 min read
A password reset is not a passkey.
The login still stores a hash and calls it modern. Passkeys are WebAuthn credentials bound to a device or a cloud vault. This page is libraries and IdPs you can name. Link identity protection for the broader desk.
Six shelves. Two open libraries. Two IdPs. One passkey SaaS. One hardware house. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| SimpleWebAuthn | Node and browser WebAuthn you can read | MIT |
| go-webauthn | Go WebAuthn on a server you own | BSD-3-Clause |
| Cisco Duo | IdP passkeys next to the MFA you already bought | Commercial |
| Microsoft Entra ID | Passkeys on the directory you already have | Microsoft terms |
| Corbado | Passkey-first SaaS for an app login | Commercial |
| Yubico | Hardware keys and reference libraries | Mixed (libs + hardware) |
SimpleWebAuthn
Best for node and browser WebAuthn you can read
Server and browser packages for WebAuthn. Types you can follow. The docs start from an origin you own.
Key features
- @simplewebauthn/server
- Browser helper
- MIT
- Passkey examples they document
Why we like it
This is the hidden gem for a Node app that should stop storing the password as the only factor.
Limits
You still design recovery. An origin mismatch fails closed. That is a feature.
go-webauthn
Best for go WebAuthn on a server you own
The Go library people actually import. Registration and assertion. You store the credential yourself.
Key features
- Registration and login
- You store credentials
- BSD-3-Clause
- Actively kept
Why we like it
When the app is Go, a SaaS passkey overlay is often vanity.
Limits
You own the user table. Recovery is still a product decision.
Cisco Duo
Best for idP passkeys next to the MFA you already bought
Duo added passkeys on the IdP you may already run. The human enrolls in their prompt, not in your app code.
Key features
- Passkeys they document
- Existing MFA estate
- SSO they sell
- Commercial
Why we like it
If the lock is already Duo, start there before you write a WebAuthn server.
Limits
Commercial. App-owned credentials still need a library. We did not run a tenant.
Microsoft Entra ID
Best for passkeys on the directory you already have
Entra documents FIDO2 and passkey sign-in for the workforce tenant. The control is a directory policy, not a Node package.
Key features
- FIDO2 / passkey policy
- Same Entra tenant
- Conditional Access neighbor
- Microsoft docs
Why we like it
Honesty. A lot of humans already live here. Do not invent a second login.
Limits
Workforce-shaped. Consumer apps still need a library. License SKUs apply.
Corbado
Best for passkey-first SaaS for an app login
Corbado sells passkey login as a service. SDKs in front of your users. You are not storing the authenticator data.
Key features
- Passkey UI they ship
- SDKs
- Hosted ceremony
- Commercial
Why we like it
When you will not staff WebAuthn, a specialist SaaS is the honest row.
Limits
Vendor lock on the login. Price. Recovery still needs a story.
Yubico
Best for hardware keys and reference libraries
YubiKeys plus developer libraries. WebAuthn, FIDO2, and the older OTP stack. The key is an object a human can lose.
Key features
- Hardware authenticators
- Reference libs
- FIDO2 they document
- You still write recovery
Why we like it
A passkey that only lives in one phone vendor is a different risk than a key on a ring.
Limits
Hardware cost. Lost-key process. Libraries are not an IdP.
What the internet thinks about passkey tools
Passkey threads treat recovery as the real product. We keep that line. A demo origin is not a program.
sandeep_random on Hacker News, Oct 2023: “If something is easy to recover for user then its same for a malicious actor.”
Prove SimpleWebAuthn still publishes
Confirm SimpleWebAuthn still publishes. Register on a staging origin you own. Do not phish anyone.
curl -fsSIL https://simplewebauthn.dev/ | head -n 8FAQs
Is a passkey MFA?
It can replace the password plus a second factor. Say what your IdP actually enrolled.
Library or IdP?
IdP if humans already live there. Library if the app owns the user table.
What about recovery?
Design it before launch. A lost phone is not an afterthought.
Is this a scored bake-off?
No. Order is editorial.
