Quiz Entry - updated: 2026.07.14
What is the difference between a platform authenticator and a cross-platform (roaming) authenticator?
A platform authenticator is built into the device (e.g. a TPM chip with Windows Hello); a cross-platform authenticator is an external device you can move between machines (e.g. a YubiKey, USB key, or smartphone).
WebAuthn lets the relying party request an authenticatorAttachment:
| Platform | Cross-platform (roaming) | |
|---|---|---|
| Where it lives | built into the device | external, portable |
| Examples | TPM + Windows Hello, Apple Touch ID/Face ID | YubiKey, USB security key, smartphone |
| Convenience | very convenient, always present | works across many devices |
| Limitation | tied to that one device | must carry/connect the device |
You set Attachment = Platform to use the machine's built-in TPM chip.
Tip: Platform = "lives in the platform (this device)"; cross-platform = "crosses between devices." A platform credential can't follow you to a new laptop unless it's synced as a passkey.