# What is an Authenticator in WebAuthn? Learn about authenticators used in WebAuthn and for passkeys. Understand platform and roaming authenticators, their significance, and how they shape UX. Created: October 29, 2023 Updated: August 22, 2026 ### Enterprise Passkey Whitepaper Practical guidance, rollout patterns and KPIs for passkey programs. [Get Whitepaper](/content/passkeys/enterprise/index.html) --- An **authenticator** is a cryptographically backed device responsible for creating and securely storing WebAuthn user credentials for an application. Here are its core functionalities: - Creates public-private-key pairs in WebAuthn / passkey authentication. - Manages the private key and uses them for signing authentication requests. - Comes in two main types: [platform authenticator](/content/glossary/platform-authenticator/index.html) and roaming authenticator. - Uses biometrics, PINs, or other methods for user authentication. ### Key Takeaways - An authenticator is a device that manages private keys for user application credentials. - Platform authenticators are device-specific like Apple's Touch ID / [Face ID](/content/faq/is-face-id-passkey/index.html) or Microsoft's [Windows Hello](/content/glossary/windows-hello/index.html). - Roaming authenticators are external devices like [hardware security keys](/content/blog/best-fido2-hardware-security-keys/index.html) (e.g. [YubiKeys](/content/glossary/yubikey/index.html)) used across various client devices --- ### Understanding Authenticators in Depth Authenticators, at their core, offer a shield of security to web and native applications, ensuring the right user accesses the right data. Let's break down the types: #### Platform Authenticator (Internal Authenticator) - **Bound to Specific Devices:** Each major tech company has its version: Apple’s Touch ID and [Face ID](/content/faq/is-face-id-passkey/index.html), Microsoft’s [Windows Hello](/content/glossary/windows-hello/index.html), and Google’s [Android](/content/blog/how-to-enable-passkeys-android/index.html) biometric features. - **Trusted Platform Module (TPM):** A built-in cryptographic element, TPM manages public and private keys. It typically uses a device's biometric capability, such as face or fingerprint scanners, for authenticating users. However, other methods like PINs in [Windows Hello](/content/glossary/windows-hello/index.html) or lock-screen patterns in [Android](/content/blog/how-to-enable-passkeys-android/index.html) smartphones are also prevalent. #### Roaming Authenticators (Cross-platform Authenticators) - **Portable and Versatile:** These are external devices that can be used with different client devices, like laptops or smartphones. They can connect using USB, NFC, or Bluetooth. - **Varieties:** The most common form are [hardware security keys](/content/blog/best-fido2-hardware-security-keys/index.html), such as [YubiKeys](/content/glossary/yubikey/index.html). Some even have fingerprint scanners, while others may require a simple button press. Knowing the categories matters, but in production it also matters which authenticators your users actually rely on. Corbado Observe's [Authenticator Inventory](/content/observe/authenticator-inventory/index.html) resolves the platform and roaming authenticators in your user base by make and model, so you see the real split between [iCloud Keychain](/content/glossary/icloud-keychain/index.html), [Google Password Manager](/content/blog/how-to-use-google-password-manager/index.html), [Windows Hello](/content/glossary/windows-hello/index.html) and [hardware security keys](/content/blog/best-fido2-hardware-security-keys/index.html) instead of guessing. Credentials without a usable [AAGUID](/content/glossary/aaguid/index.html) stay visible as an unresolved group rather than being dropped. ### Authenticator FAQs #### What is the primary function of an authenticator? An authenticator is a cryptographically supported device used for creating and securely storing user credentials for an application. Its primary function is to create public-private-key pairs, manage the private key and utilize it for signing authentication requests. #### How do platform authenticators differ from roaming authenticators? Platform authenticators are device-specific, like Apple's Touch ID / [Face ID](/content/faq/is-face-id-passkey/index.html), and are bound to a particular device. In contrast, roaming authenticators are external, portable devices, such as security keys, that can be used across different client devices. #### Can roaming authenticators be used for sharing passkeys? Roaming authenticators should not be mistaken for [passkey sharing](/content/blog/passkeys-sharing/index.html) capabilities like [QR code](/content/blog/qr-code-login-authentication/index.html) scanning, Bluetooth, or [AirDrop](/content/blog/share-passkeys-apple-devices/index.html). They serve different purposes in the realm of user authentication. ## About Corbado Corbado is the **Passkey Intelligence Platform** for large-scale CIAM teams running consumer authentication. We help you see what IDP logs and generic analytics tools can't: where passkeys, passwords, OTP, social login and fallback journeys succeed, stall or fail, which devices and browsers create friction, and when an OS update silently breaks login. Two products: **Corbado Observe** layers **process mining and observability across authentication journeys.** **Corbado Connect** adds **managed passkeys with analytics built in** alongside your IDP. VicRoads runs passkeys for 5M+ users with Corbado (more than 80% passkey activation rate). --- ## Related Terms - [**Passkey**](/content/glossary/passkey/index.html) - [**WebAuthn**](/content/glossary/webauthn/index.html) - [**FIDO2**](/content/glossary/fido2/index.html) - [**CTAP (Client-to-Authenticator-Protocol)**](/content/glossary/ctap/index.html) - [**TPM (Trusted Platform Model)**](/content/glossary/trusted-platform-module/index.html)