Browser security
Compatibility & evidence
Authentication

WebAuthn PRF extension

Derives scoped pseudorandom outputs from a compatible WebAuthn credential.

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.1.5.

BrowserMinimumOutcomeReason
Chrome155WorksEvery required mapped BCD feature is available without a recorded qualification.
Edge154WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari27Not supportedAt least one required mapped feature is not available at this browser baseline.
Chrome for Android155WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox for Android157Not supportedAt least one required mapped feature is not available at this browser baseline.
Safari on iOS27Not supportedAt least one required mapped feature is not available at this browser baseline.
Android WebView155Not supportedAt least one required mapped feature is not available at this browser baseline.
Samsung Internet30.0WorksEvery required mapped BCD feature is available without a recorded qualification.
The release trace

How support changed

Each segment groups recorded releases with the same result. Gaps between recorded versions are not filled in. This is support at each release, rather than the planner’s check of every release above a minimum.

Chrome

api.CredentialsContainer.create.publicKey_option.extensions.prf
  1. 1 – 115114 recorded releases
    Not supported
  2. 116 – 15540 recorded releases
    Works
api.CredentialsContainer.get.publicKey_option.extensions.prf
  1. 1 – 115114 recorded releases
    Not supported
  2. 116 – 15540 recorded releases
    Works

Edge

api.CredentialsContainer.create.publicKey_option.extensions.prf
  1. 12 – 11543 recorded releases
    Not supported
  2. 116 – 15439 recorded releases
    Works
api.CredentialsContainer.get.publicKey_option.extensions.prf
  1. 12 – 11543 recorded releases
    Not supported
  2. 116 – 15439 recorded releases
    Works

Firefox

api.CredentialsContainer.create.publicKey_option.extensions.prf
  1. 1 – 134137 recorded releases
    Not supported
    • Partial implementation
    • Not supported on macOS.
  2. 135 – 1384 recorded releases
    Works with limits
    • Partial implementation
    • Not supported on macOS.
  3. 139 – 15719 recorded releases
    Works
api.CredentialsContainer.get.publicKey_option.extensions.prf
  1. 1 – 134137 recorded releases
    Not supported
    • Partial implementation
    • Not supported on macOS.
  2. 135 – 1384 recorded releases
    Works with limits
    • Partial implementation
    • Not supported on macOS.
  3. 139 – 15719 recorded releases
    Works

Safari

api.CredentialsContainer.create.publicKey_option.extensions.prf
  1. 1 – 17.646 recorded releases
    Not supported
  2. 18 – 2715 recorded releases
    Works
api.CredentialsContainer.get.publicKey_option.extensions.prf
  1. 1 – 2761 recorded releases
    Not supported

Chrome for Android

api.CredentialsContainer.create.publicKey_option.extensions.prf
  1. 18 – 11591 recorded releases
    Not supported
  2. 116 – 15540 recorded releases
    Works
api.CredentialsContainer.get.publicKey_option.extensions.prf
  1. 18 – 11591 recorded releases
    Not supported
  2. 116 – 15540 recorded releases
    Works

Firefox for Android

api.CredentialsContainer.create.publicKey_option.extensions.prf
  1. 4 – 148132 recorded releases
    Not supported
  2. 149 – 1579 recorded releases
    Works
api.CredentialsContainer.get.publicKey_option.extensions.prf
  1. 4 – 157141 recorded releases
    Not supported

Safari on iOS

api.CredentialsContainer.create.publicKey_option.extensions.prf
  1. 1 – 17.643 recorded releases
    Not supported
  2. 18 – 2715 recorded releases
    Works
api.CredentialsContainer.get.publicKey_option.extensions.prf
  1. 1 – 2758 recorded releases
    Not supported

Android WebView

api.CredentialsContainer.create.publicKey_option.extensions.prf
  1. 1 – 155126 recorded releases
    Not supported
api.CredentialsContainer.get.publicKey_option.extensions.prf
  1. 1 – 155126 recorded releases
    Not supported

Samsung Internet

api.CredentialsContainer.create.publicKey_option.extensions.prf
  1. 1.0 – 23.045 recorded releases
    Not supported
  2. 24.0 – 30.07 recorded releases
    Works
api.CredentialsContainer.get.publicKey_option.extensions.prf
  1. 1.0 – 23.045 recorded releases
    Not supported
  2. 24.0 – 30.07 recorded releases
    Works

BCD 8.1.5 · catalogue 2.3.0. Source corrections can change this trace without a new browser release.

What this feature can and cannot do

Helps protect against

  • Exportable application key material
  • Password-derived local secrets

Does not guarantee

  • Account recovery
  • Relying-party verification
  • Every authenticator

What you need before using it

  • A compatible authenticator
  • A reviewed WebAuthn extension design

Fallback to keep in place

Keep key derivation and recovery independent of the extension where it is unavailable.