What Is WebAuthn Level 3 & How Does Enpass Support It?

WebAuthn Level 3 is the newest version of the passkey standard, and it expands what a passkey can do well beyond signing in. The update lets a passkey help protect encrypted data, work across an organization’s related domains, get created without interrupting a login flow, and stay accurate automatically when account details change. Enpass has already implemented the essential WebAuthn Level 3 capabilities, making it one of the first password managers to do so. 

How are passkeys different from passwords? 

Stolen credentials are one of the most common ways attackers get into an organization’s systems, and passwords are a frequent point of failure because they’re typed, reused, and easy to phish. Passkeys were built to remove that weak point by replacing a typed secret with cryptography. 

A passkey replaces a password with two cryptographic keys: 

• Public key: The website a user is logging into stores this. 
• Private key: The credential manager securely stores this.  

During sign-in, the device proves it holds the private key without ever sharing it, so there’s no typed secret for an attacker to steal or phish. 

This device-side private key model comes from the WebAuthn standard, the technical standard behind every passkey. It’s what lets a passkey work consistently across browsers, devices, websites, and password managers, and it’s maintained by the World Wide Web Consortium (W3C) through a formal, multi-year consensus process.  

Therefore, the private key is not from any one password manager’s architecture. In Enpass’s case, that key sits inside your encrypted vault, and the vault lives in your organization’s own Microsoft 365, Google Workspace, Nextcloud or other trusted environment rather than on Enpass’s servers. 

Biometrics such as a fingerprint or Face ID are the steps that unlock the private key on your device. They don’t replace the cryptographic proof; they make triggering it faster. 

What’s new in WebAuthn Level 3? 

WebAuthn Level 3 is the newest version of the W3C WebAuthn standard. It’s maintained by the World Wide Web Consortium (W3C) in collaboration with the FIDO Alliance, the industry body behind the broader passkey ecosystem.

It adds capabilities that make passkeys easier to use and manage – and useful for more than logging in because it lets the cryptography do more than authenticate a sign-in.

Enpass has already implemented the essential WebAuthn Level 3 capabilities into its passkeys ahead of the formal W3C recommendation. 

Summary of WebAuthn Level 3 changes

Each row links to a fuller explanation that you can find below. 

Let’s look at each of these in more detail. 

Protect encrypted data with passkeys 

To date, passkeys have mainly been used to authenticate users. The PRF (Pseudo-Random Function) extension lets applications use a passkey to generate encryption keys as well. This means a passkey can help protect encrypted data, such as backups, without requiring another password to create and remember. 

Enpass supports the PRF extension, so users are ready for these encryption-based experiences as websites adopt them. 

Use one passkey across related websites 

Many organizations operate multiple websites under different domains. Related Origin Requests (ROR) let these websites identify themselves as related, so a single passkey works across them. That reduces duplicate credentials and cuts down on redundant sign-in setup. 

Switch to passkeys without disrupting workflows 

Conditional Create lets websites offer passkey creation during an existing sign-in flow. Conditional Get lets saved passkeys appear directly in autofill suggestions. Together, they let creating and using a passkey become part of the normal login flow rather than a separate step, so moving from passwords doesn’t require a dedicated onboarding moment for every user. 

Keep saved passkeys up to date 

The Signal API lets websites notify password managers like Enpass when a passkey has been revoked or when account details change. This keeps saved credentials accurate and reduces outdated or duplicate entries without manual clean-up. 

Get the right authentication experience 

Not every website expects the same authentication method. Public Key Credential Hints let a website communicate its requirements up front, so browsers and password managers like Enpass can offer the sign-in option that the website or app expects, rather than guessing. 

Why WebAuthn Level 3 matters 

WebAuthn Level 3 is the next version of the passkey standard, and password managers need to support it for websites to deliver these capabilities as they roll out. Enpass has implemented the essential capabilities ahead of the formal W3C recommendation. 

But adopting a standard early only matters if the architecture underneath it holds up. A passkey is only as secure as where it’s stored. If a password manager centralizes those keys on its own servers, it recreates a vital security risk – because that single vendor becomes a single target as we’ve seen with recent breaches. 

Enpass continues to provide data sovereignty with passkeys, without requiring self-hosting. Every passkey in Enpass, including the new WebAuthn Level 3 capabilities, is stored under the same principle as every other credential: inside your organization’s own Microsoft 365, Google Workspace, or other trusted environment, never on Enpass’s servers. While zero knowledge is the industry norm for password managers, Enpass goes a step further with zero possession – we never receive, store, or touch your password or passkey data in the first place. 

Frequently asked questions 

Is Enpass’s passkey support tied to Enpass’s own servers? 

No. Enpass offers complete data sovereignty without requiring self-hosting. Every passkey, like every password, lives inside your organization’s own Microsoft 365, Google Workspace, or other trusted environment. Enpass orchestrates access; it never stores or possesses the credential itself. Because there’s nothing on Enpass servers to begin with, there’s no vendor breach risk to worry about.   

Do I need to do anything to get WebAuthn Level 3 capabilities in Enpass? 

No setup is needed on your end. Enpass already supports the essential WebAuthn Level 3 capabilities. Websites will decide when a capability actually activates: each site has to adopt WebAuthn Level 3 first, then request it from your password manager. Enpass is ready now, so nothing on our end holds you back once websites begin rolling out support for them.