What is the WebAuthn PRF extension?

The PRF (Pseudo-Random Function) extension is a WebAuthn extension that allows deriving stable, hardware-bound symmetric keys from a passkey. It enables use cases like end-to-end encryption, passwordless vault decryption and secure key derivation without a master password.

Which browsers support the WebAuthn PRF extension?

PRF extension support varies by browser, operating system and authenticator. Chrome, Edge and Firefox on desktop generally support PRF with platform authenticators. Safari support depends on the macOS or iOS version. Use this demo to test your specific combination.

Does PRF work with security keys like YubiKey?

Yes, security keys that support the hmac-secret extension (like YubiKey 5 series) can use PRF through the WebAuthn API. The hmac-secret CTAP2 extension is the underlying mechanism that browsers expose via the PRF WebAuthn extension.

WebAuthn PRF Extension Demo

Test whether your browser and authenticator support the WebAuthn PRF (Pseudo-Random Function) extension for deriving encryption keys from passkeys. The PRF extension enables end-to-end encryption, passwordless vault decryption and secure key derivation without a master password.

What this demo tests

PRF support during passkey registration (navigator.credentials.create)
PRF support during passkey authentication (navigator.credentials.get)
Authenticator compatibility: platform authenticators (Touch ID, Face ID, Windows Hello) and security keys (YubiKey, Titan)

Community PRF compatibility stats

View aggregated PRF support results across operating systems, browsers and authenticators submitted by the community.

Read the full article on Corbado's blog