Fido2

Pulling Encryption Keys Out of Passkeys with the WebAuthn PRF Extension

• whackur
• Security
• July 3, 2026

Passkeys show up on login screens everywhere now. What’s less well known is that the same authenticator holding your passkey can also hand out key material for encryption, not just authentication. The prf extension in WebAuthn is that path. This post covers what PRF actually returns, how it relates to the CTAP2 hmac-secret extension, what you still have to build yourself before it’s usable for real encryption, and where device and platform support stand as of 2026.