WebAuthn drastically improves authentication. For starters, it doesn't release any secret information into the wild. Instead, it uses a public/private key pai

WebAuthn drastically improves authentication. For starters, it doesn't release any secret information into the wild. Instead, it uses a public/private key pair to challenge the user to decrypt something that only she or he can decrypt. The website (as an example) no longer stores anything but your public key, which doesn't reveal anything. Secondly, you can't give away your passkey information so it is for all practical purposes unphishable. (I can't conceive of a way that it might be phished, but that doesn't mean there isn't one.) In addition, it is super-duper easy on users. They don't have to remember anything, and can login with the touch of a finger or a glance at the camera. This is a huge step forward in authentication.