FortAuth · Passwordless authentication

Passwordless today, quantum-safe for tomorrow.

FortAuth replaces passwords with device-bound FIDO2 passkeys. They are fast for people and phishing-proof for attackers. Private keys and biometrics never leave the device, so there is nothing to phish, guess, or leak.

As post-quantum signature algorithms come to FIDO2, passkeys will stay unforgeable even against a quantum computer, and a crypto-agile design means adopting them is a rollout, not a re-architecture.

FortAuth replaces passwords with device-bound FIDO2 passkeys. They are phishing-proof for attackers, and crypto-agile, so post-quantum signatures are a rollout rather than a rebuild.

Face ID

Fingerprint

Device PIN

Screen pattern

fortanixorSearchAlex MorganACME CORPAM

Dashboard

FortAuth: Sign-ins that can't be phished.

FortAuth replaces passwords with device-bound passkeys. People sign in faster, and there is nothing left for an attacker to phish.

Everything passwords aren't

The reasons security and product teams move their logins to FortAuth.

Drops into your stack

Native SDKs for Swift, Kotlin, Java, React, Angular and Flutter, plus a clean REST API. Ship passwordless login in hours, not quarters.

SDKs for every stack

JSTSJSTS

Passkeys, everywhere

One key per device, on every platform

Phishing

Resistance

FIDO2

100%

Origin-bound sign-inBy design

Passwords to steal

There is nothing to phish, guess or leak. Every key is device-bound and never shared with the server.

Verify however you like

Face ID, fingerprint, PIN or pattern unlocks your passkey on the device itself. Only a signed challenge ever leaves it.

Face IDFingerprintPINPattern

Verification speed

One tap, no waiting

No codes and no resets. A passkey sign-in finishes in well under a second.

<1s

Certified & compliant

Audited to standards you trust

Independently verified against the frameworks banks and regulators require.

FIDO2 CertifiedISO 27001

Crypto-agile by architecture

Crypto-agile today, post-quantum next

Passkeys sign with ECDSA today. As FIDO2 adopts post-quantum signature algorithms, starting most likely with NIST’s ML-DSA, a crypto-agile design lets us take them up as the spec and the authenticators support them, without re-architecting your integration. Signatures are not exposed to harvest-now-decrypt-later, so what matters is being able to move before a cryptographically-relevant quantum computer exists.

FIDO2 passkeys on a crypto-agile design, ready to adopt post-quantum signatures as FIDO2 standardises them.

Crypto-agileML-DSA roadmapStandards-trackingQ-Day prepared

Q-Day

prepared

One tap on the phone. A whole handshake behind it.

9:41

Welcome back

alex@company.com

Continue with Google

Continue with Microsoft

Secured by Fortanixor

Scroll to explore

Device fingerprinting

Each device is given a unique ID and recognised by it every time you sign in.

3-D Secure

Debit Card

1234567890123456

Alex MorganVALID
THRU09/32

Approve the transaction with your passkey instead of an OTP.

Approve on your phone

FortAuthnowApprove sign inMacBook Pro · Chrome · 2 min ago

A sign in started on another device waits here for your approval.

QR based login

Scan with your phone to withdraw. No card or PIN needed.

Device access

Trust the person. Verify the device.

The passkey ties every sign-in to specific hardware and the person holding it. On top of that, FortAuth hardens the client itself. It fingerprints the device, locks down the screen and watches the network, so a stolen credential has nowhere to run.

Passwordless

Nothing to phish. Nothing to leak.

Passwords, OTPs, and push prompts all share one flaw: a secret that travels and can be intercepted, reused, or fatigued into approval. FortAuth passkeys replace them with FIDO2 public-key credentials that stay bound to the device and the real site.

// the options your server returns - spec

// field names only, no wrapper, no vendor key

{

"challenge": "9WqE4h1tKf0v2Nx7bQ",

"rpId": "example.com",

"userVerification": "required",

"timeout": 60000,

"allowCredentials": [

{

"type": "public-key",

"id": "AY5kQ2r8...T1c",

"transports": ["internal", "hybrid"]

}

]

}

// hand it straight to the browser

const credential =

await navigator.credentials.get({

publicKey: options,

});

// what comes back is spec-shaped too

{

"id": "AY5kQ2r8...T1c",

"response": {

"authenticatorData": "SZYN5Y...",

"clientDataJSON": "eyJ0eXBl...",

"signature": "MEUCIQD..."

},

"type": "public-key"

}

// the options your server returns - spec

// field names only, no wrapper, no vendor key

{

"challenge": "9WqE4h1tKf0v2Nx7bQ",

"rpId": "example.com",

"userVerification": "required",

"timeout": 60000,

"allowCredentials": [

{

"type": "public-key",

"id": "AY5kQ2r8...T1c",

"transports": ["internal", "hybrid"]

}

]

}

// hand it straight to the browser

const credential =

await navigator.credentials.get({

publicKey: options,

});

// what comes back is spec-shaped too

{

"id": "AY5kQ2r8...T1c",

"response": {

"authenticatorData": "SZYN5Y...",

"clientDataJSON": "eyJ0eXBl...",

"signature": "MEUCIQD..."

},

"type": "public-key"

}

// 1 - begin the assertion

const options = await api.post(

"/assertion/options", { userId }

);

const assertion =

await navigator.credentials.get({

publicKey: options,

});

// 2 - verify it

const { session } = await api.post(

"/assertion/result", assertion

);

// that is the whole ceremony - no hosted

// page, no callback URL, no redirect

req.session.user = session.user;

// registration is the same two calls

const opts = await api.post(

"/attestation/options"

);

const cred =

await navigator.credentials.create({

publicKey: opts,

});

await api.post("/attestation/result", cred);

// 1 - begin the assertion

const options = await api.post(

"/assertion/options", { userId }

);

const assertion =

await navigator.credentials.get({

publicKey: options,

});

// 2 - verify it

const { session } = await api.post(

"/assertion/result", assertion

);

// that is the whole ceremony - no hosted

// page, no callback URL, no redirect

req.session.user = session.user;

// registration is the same two calls

const opts = await api.post(

"/attestation/options"

);

const cred =

await navigator.credentials.create({

publicKey: opts,

});

await api.post("/attestation/result", cred);

// one credential, one rpId, four surfaces

const rpId = "example.com";

// web and mobile app: the same assertion

await navigator.credentials.get({

publicKey: options,

});

// cardless ATM: the phone answers for the

// machine, over cross-device transport

options.allowCredentials[0]

.transports = ["hybrid"];

// payment step-up: SPC binds amount and

// payee into what gets signed - the

// dynamic linking SCA asks for

await new PaymentRequest([{

supportedMethods:

"secure-payment-confirmation",

data: {

rpId,

credentialIds: [credentialId],

challenge,

payeeName: "ACME Ltd",

instrument: {

displayName: "Visa ...4821",

},

}], {

total: {

amount: {

currency: "AED",

value: "420.00",

},

}]).show();

// wire it once. a new surface is a client

// call, not another project.

// one credential, one rpId, four surfaces

const rpId = "example.com";

// web and mobile app: the same assertion

await navigator.credentials.get({

publicKey: options,

});

// cardless ATM: the phone answers for the

// machine, over cross-device transport

options.allowCredentials[0]

.transports = ["hybrid"];

// payment step-up: SPC binds amount and

// payee into what gets signed - the

// dynamic linking SCA asks for

await new PaymentRequest([{

supportedMethods:

"secure-payment-confirmation",

data: {

rpId,

credentialIds: [credentialId],

challenge,

payeeName: "ACME Ltd",

instrument: {

displayName: "Visa ...4821",

},

}], {

total: {

amount: {

currency: "AED",

value: "420.00",

},

}]).show();

// wire it once. a new surface is a client

// call, not another project.

// a virtual authenticator, so CI needs no

// hardware and no hands on a phone

await cdp.send("WebAuthn.enable");

const { authenticatorId } = await cdp.send(

"WebAuthn.addVirtualAuthenticator", {

options: {

protocol: "ctap2",

transport: "internal",

hasUserVerification: true,

isUserVerified: true,

},

}

);

await signIn(page, "alex@company.com");

// every ceremony lands in the event log

// with the reason it passed or failed

expect(await lastCeremony()).toMatchObject({

status: "ok",

userVerified: true,

origin: "https://example.com",

counter: 41,

});

// a virtual authenticator, so CI needs no

// hardware and no hands on a phone

await cdp.send("WebAuthn.enable");

const { authenticatorId } = await cdp.send(

"WebAuthn.addVirtualAuthenticator", {

options: {

protocol: "ctap2",

transport: "internal",

hasUserVerification: true,

isUserVerified: true,

},

}

);

await signIn(page, "alex@company.com");

// every ceremony lands in the event log

// with the reason it passed or failed

expect(await lastCeremony()).toMatchObject({

status: "ok",

userVerified: true,

origin: "https://example.com",

counter: 41,

});

Built for developers

Drop it in. Ship it this sprint.

FortAuth speaks FIDO2 and OIDC on the wire, so it plugs into the stack you already run. Add a couple of calls to the login screen you have, keep your identity provider, and roll passwordless out one app at a time.

Passwordless today, quantum-safe for tomorrow.

Welcome back

Sign In

Sign in

FortAuth: Sign-ins that can't be phished.

Drops into your stack

Passwords to steal

One tap, no waiting

Audited to standards you trust

Crypto-agile today, post-quantum next

One tap on the phone. A whole handshake behind it.

Welcome back

Trust the person. Verify the device.

Nothing to phish. Nothing to leak.

Drop it in. Ship it this sprint.