FIDO2
FIDO2 is the combination of the W3C Web Authentication specification and FIDO Client to Authenticator Protocols that supports public-key authentication through browsers, platforms, and authenticators.
Two standards, two jobs
WebAuthn lets a website ask a browser or platform to register and use a public-key credential. CTAP handles communication with external authenticators, such as a security key connected over USB or NFC. Together, these specifications make up FIDO2.
FIDO2 names the standards. A passkey is a credential, and a security key is one place to keep it. Those terms describe different parts of a sign-in.
Phishing resistance and MFA answer different questions
WebAuthn binds authentication to the intended service. NIST identifies that binding as a phishing-resistant mechanism: an impostor website cannot simply collect a response and reuse it at the real service. A manually entered one-time code lacks that binding.
FIDO2 supports several sign-in experiences, including second-factor and passwordless use. To understand a particular deployment, ask whether the authenticator requires user verification, such as a PIN or biometric check. A product’s FIDO2 support alone does not describe every factor used in a sign-in.