FIDO2 Resident Key vs Non-Resident Key — Discoverable Credentials Explained
When you create a WebAuthn credential, you choose whether it's resident (discoverable) or non-resident (wrapped). This choice affects everything: usernameless login, storage limits, privacy, and which extensions work. Here's the technical comparison.
How They Work
| Non-Resident (Wrapped) | Resident (Discoverable) | |
|---|---|---|
| Private Key Storage | Encrypted with authenticator master key, stored off-device in the credential ID blob (RP keeps it) | Stored on-device in authenticator flash |
| Credential ID | Contains encrypted private key + RP ID (opaque, ~200-280 bytes) | Opaque index into authenticator storage (~30-80 bytes) |
| Capacity | Unlimited — RP stores the blob | Limited: 25-100 per authenticator |
| Usernameless Login | No — RP must provide allowCredentials | Yes — authenticator provides user handle |
| WebAuthn Support | residentKey: "discouraged" | residentKey: "required" |
| hmac-secret Extension | Yes | Yes |
| credBlob Extension | No (no on-device storage) | Yes (small blob stored with key) |
| Privacy | Better — RP stores user data | Worse — user handle stored on key |
When to Use Each
Use Non-Resident (wrapped) keys when:
- You have many users per authenticator — non-resident scales infinitely
- You have a username field on your login form — you know who the user is
- You need maximum authenticator compatibility — all FIDO2 keys support non-resident
- Privacy is important — user identity data stays on the RP server, not on the key
This is what most websites use today. The user types their username, the RP sends allowCredentials, and the authenticator signs the challenge.
Use Resident (discoverable) keys when:
- You want usernameless login — user just taps the key, no username needed
- You're building re-authentication flows (the user is already known)
- You need the credBlob extension (small data stored with credential)
- You're implementing passkeys — the modern multi-device FIDO2 credential
This is the future direction (passkeys). But the limited storage per authenticator is a real constraint — YubiKey 5 stores only 25 resident credentials.
Verify Your Key's Firmware
Use our FIDO2 CBOR Attestation Parser to decode your security key's attestation and check the AAGUID, credential storage limits, and supported extensions.
Related
FIDO2 & CTAP Protocol Guide | FIDO2 Attestation Parser | Best Security Keys