WebAuthn / Passkey Authentication for Home Assistant (Marketplace integration)

Installs: 60 sharing analytics
GitHub stars: 28
Connection: Works locally
Upkeep: Updated in the last 6 months
Version: v1.6.0, October 27, 2026
Category: Security and safety, Locks and access
Kind: Marketplace integration
Needs: Needs the Marketplace (HACS on 2026.10 and older)
Domain: webauthn_mfa
Source: github.com/Anrolosia/ha-webauthn-mfa
Issues: Report an issue

Independent directory, made by the developer of Vulpo. Not affiliated with Home Assistant or the Open Home Foundation.

About

WebAuthn / Passkey Authentication adds passkey sign-in to Home Assistant, so users can log in without a password. It registers a WebAuthn login provider when Home Assistant starts, and each user adds and manages their own passkeys from a dedicated sidebar panel. Sign-in works with fingerprint, face scan, security keys and password managers that support FIDO2 passkeys. Passkeys are bound to the configured domain, which makes them resistant to fake login pages. The login screen, passkey prompt and sidebar panel follow the Home Assistant interface language, with English, French, German, Spanish and Dutch available. Setup is done in the UI with a relying party ID, a display name and the expected origin URL, and these can be changed later in the integration options.

Automatic summary of the README and code of Anrolosia/ha-webauthn-mfa. Something wrong, or are you the maintainer and want your own text here? Get in touch

Supports

Works locally Talks to your devices on your own network. No vendor cloud in between.
From the Marketplace Installed through the Marketplace, formerly HACS.
Actively maintained Its author released or pushed a change in the last six months.

Setting it up

Install it from the Marketplace and restart Home Assistant, then add it under Settings, Devices and services.

WebAuthn / Passkey Authentication Setup

Relying Party IDThe domain name of your Home Assistant instance, without scheme or port. Use homeassistant.local or ha.example.com.
Relying Party NameA human-readable name shown in passkey prompts, such as Home Assistant.
Expected OriginThe full URL(s) users use to access Home Assistant. Enter each URL on a new line, including scheme and non-standard port.

After setup

Relying Party IDThe domain name of your Home Assistant instance, without scheme or port. Use homeassistant.local or ha.example.com.
Relying Party NameA human-readable name shown in passkey prompts, such as Home Assistant.
Expected OriginThe full URL(s) users use to access Home Assistant. Enter each URL on a new line, including scheme and non-standard port.

Texts from the code of Anrolosia/ha-webauthn-mfa.

From the README

Passkey authentication for Home Assistant — sign in with a fingerprint, face scan, or security key. No password required.
Passwordless login — replace passwords entirely with FIDO2 passkeys.
Phishing-resistant — credentials are cryptographically bound to your domain; they cannot be stolen by a fake login page.
Multi-user — each Home Assistant user registers and manages their own passkeys independently.
Broad authenticator support — works with Bitwarden, 1Password, YubiKey, Face ID, Touch ID, Windows Hello, and any FIDO2-compatible authenticator.
Dedicated sidebar panel — register, rename, and delete passkeys without leaving Home Assistant.
Persistent sessions — the "Stay signed in" option works correctly alongside the native HA Service Worker token flow.
Cross-platform — any modern browser (Chrome, Firefox, Safari, Edge) on desktop or mobile.
Fully multilingual frontend — the login overlay, the passkey prompt page, and the sidebar panel all follow the Home Assistant UI language (English, French, German, Spanish, Dutch).

From the README of Anrolosia/ha-webauthn-mfa, MIT License. Shortened.