---
title: "Introduction"
manual: "Passkeys Backend Authentication"
version: "1.0"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-passkeys-be:introduction@1.0"
source: "Introduction/Index.rst"
rendered: "2026-09-20T16:07:13+00:00"
---

# Introduction {#introduction}

## What does it do? {#what-does-it-do}

Passkeys Backend Authentication provides passwordless authentication
for the TYPO3 backend using the WebAuthn/FIDO2 standard (Passkeys).
Backend users can log in with a single touch or glance using biometric
authenticators such as TouchID, FaceID, Windows Hello, or hardware
security keys like YubiKey.

The passkey button is injected directly into the **standard TYPO3 login
form** via a PSR-14 event listener -- no login provider switching
needed. Users see the familiar login page with a
**Sign in with a passkey** button below the Login button.

Passkeys are a modern, phishing-resistant replacement for passwords.
They use public-key cryptography: the private key never leaves the
user's device, and the server only stores a public key. This eliminates
the risk of credential theft through phishing or database breaches.

## Features {#features}

**Passwordless login**

Authenticate with TouchID, FaceID, YubiKey, or Windows Hello
instead of a password. Injected directly into the standard
TYPO3 login form.

**Primary credential**

Passkeys are a first-class authentication method (not MFA).
The extension registers at priority 80, above the standard
password service.

**Credential management**

Users can register, rename, and remove their own passkeys
through the TYPO3 User Settings module.

**Admin panel**

Administrators can list, revoke, and manage passkeys for any
backend user, and unlock locked-out accounts.

**Discoverable login**

Optional usernameless login (Conditional UI) where the browser
auto-suggests available passkeys. Controlled via extension
settings.

**Security hardened**

HMAC-signed challenges with nonce replay protection, rate
limiting by IP, account lockout, user enumeration prevention,
and audit logging.

**Configurable algorithms**

Supports ES256, ES384, ES512, and RS256 signing algorithms.
Configurable user verification requirement.

**TYPO3 v12, v13, and v14**

Compatible with TYPO3 12.4 LTS, 13.4 LTS, and 14.x.
PHP 8.2, 8.3, 8.4, and 8.5 supported.

## Supported authenticators {#supported-authenticators}

Any FIDO2/WebAuthn-compliant authenticator works, including:

-   Apple TouchID and FaceID (macOS, iOS, iPadOS)
-   Windows Hello (fingerprint, face, PIN)
-   YubiKey 5 series and newer
-   Android fingerprint and face unlock
-   Any FIDO2-compliant hardware security key

## Browser support {#browser-support}

WebAuthn is supported by all modern browsers:

| Browser | Version |
| --- | --- |
| Chrome / Edge | 67+ |
| Firefox | 60+ |
| Safari | 14+ |
| Chrome for Android | 70+ |
| Safari for iOS | 14.5+ |