A platform authenticator is a built-in device authentication component, such as Windows Hello, that creates, stores, or unlocks credentials locally on a phone, laptop, or desktop. In WebAuthn and passkey systems, it uses device hardware and local user verification, such as a PIN, fingerprint, or face scan, to approve a login without sending the private key off the device.
This matters because the security of the sign-in flow depends on the trustworthiness of the endpoint. Platform authenticators can reduce password phishing and credential reuse, but they also move risk to the device itself: malware, weak device policy, stolen unlocked sessions, or poor account recovery can undermine them. Defenders use them with TPM or Secure Enclave protection, endpoint hardening, and careful fallback design so a lost device does not become an easy account takeover path.