How do FIDO2 and WebAuthn hardware security keys work at the browser and server interaction level?

Hardware security keys, such as YubiKey, are physical devices that connect to a computer or smartphone via USB, NFC, or Bluetooth. They implement cryptographic authentication based on the FIDO2 and WebAuthn standards, completely eliminating the need to transmit passwords over the network. When a user attempts to log into a site, the server generates a unique random sequence of bytes and sends it to the browser along with the requested domain identifier.

The browser passes this request to the connected hardware key. The key checks whether the server domain matches the one saved during registration, making phishing virtually impossible since a fake site cannot impersonate the real one. To confirm the operation, the device requires physical action from the user, such as pressing a touch button or entering a PIN code directly on the token itself.

Upon confirmation, the key uses a built-in secure microchip to create a digital signature using asymmetric cryptography. During initial registration on the site, a unique key pair is generated: the public key is sent and stored on the server, while the private key never leaves the secure memory of the hardware device. During subsequent logins, the key signs the server's random challenge using the private key, and the server verifies the signature using the stored public key.

This method provides the maximum level of protection against credential interception, server-side database leaks, and Man-in-the-Middle attacks. Even if the server database is completely compromised by attackers, they will only be left with public keys, which cannot be used to log into the system or recover the original private key.