diff --git a/package.json b/package.json
index fca48658..400cdc6c 100755
--- a/package.json
+++ b/package.json
@@ -32,7 +32,6 @@
     "@fastify/rate-limit": "^10.3.0",
     "@fastify/sensible": "^6.0.4",
     "@fastify/static": "^8.3.0",
-    "@github/webauthn-json": "^2.1.1",
     "@mantine/charts": "^8.3.9",
     "@mantine/code-highlight": "^8.3.9",
     "@mantine/core": "^8.3.9",
@@ -47,6 +46,8 @@
     "@prisma/engines": "6.13.0",
     "@prisma/internals": "6.13.0",
     "@prisma/migrate": "6.13.0",
+    "@simplewebauthn/browser": "^13.2.2",
+    "@simplewebauthn/server": "^13.2.2",
     "@smithy/node-http-handler": "^4.1.1",
     "@tabler/icons-react": "^3.35.0",
     "archiver": "^7.0.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 198b8ce4..822ee8fc 100755
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -41,9 +41,6 @@ importers:
       '@fastify/static':
         specifier: ^8.3.0
         version: 8.3.0
-      '@github/webauthn-json':
-        specifier: ^2.1.1
-        version: 2.1.1
       '@mantine/charts':
         specifier: ^8.3.9
         version: 8.3.9(@mantine/core@8.3.9(@mantine/hooks@8.3.9(react@19.2.1))(@types/react@19.2.7)(react-dom@19.2.1(react@19.2.1))(react@19.2.1))(@mantine/hooks@8.3.9(react@19.2.1))(react-dom@19.2.1(react@19.2.1))(react@19.2.1)(recharts@2.15.4(react-dom@19.2.1(react@19.2.1))(react@19.2.1))
@@ -86,6 +83,12 @@ importers:
       '@prisma/migrate':
         specifier: 6.13.0
         version: 6.13.0(@prisma/internals@6.13.0(typescript@5.9.3))(typescript@5.9.3)
+      '@simplewebauthn/browser':
+        specifier: ^13.2.2
+        version: 13.2.2
+      '@simplewebauthn/server':
+        specifier: ^13.2.2
+        version: 13.2.2
       '@smithy/node-http-handler':
         specifier: ^4.1.1
         version: 4.1.1
@@ -1059,9 +1062,8 @@ packages:
   '@floating-ui/utils@0.2.10':
     resolution: {integrity: sha512-aGTxbpbg8/b5JfU1HXSrbH3wXZuLPJcNEcZQFMxLs3oSzgtVu6nFPkbbGGUvBcUjKV2YyB9Wxxabo+HEH9tcRQ==}
 
-  '@github/webauthn-json@2.1.1':
-    resolution: {integrity: sha512-XrftRn4z75SnaJOmZQbt7Mk+IIjqVHw+glDGOxuHwXkZBZh/MBoRS7MHjSZMDaLhT4RjN2VqiEU7EOYleuJWSQ==}
-    hasBin: true
+  '@hexagon/base64@1.1.28':
+    resolution: {integrity: sha512-lhqDEAvWixy3bZ+UOYbPwUbBkwBq5C1LAJ/xPC8Oi+lL54oyakv/npbA0aU2hgCsx/1NUd4IBvV03+aUBWxerw==}
 
   '@humanfs/core@0.19.1':
     resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==}
@@ -1244,6 +1246,9 @@ packages:
   '@jridgewell/trace-mapping@0.3.31':
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
+  '@levischuck/tiny-cbor@0.2.11':
+    resolution: {integrity: sha512-llBRm4dT4Z89aRsm6u2oEZ8tfwL/2l6BwpZ7JcyieouniDECM5AqNgr/y08zalEIvW3RSK4upYyybDcmjXqAow==}
+
   '@lukeed/ms@2.0.2':
     resolution: {integrity: sha512-9I2Zn6+NJLfaGoz9jN3lpwDgAYvfGeNYdbAIjJOqzs4Tpc+VU3Jqq4IofSUBKajiDS8k9fZIg18/z13mpk1bsA==}
     engines: {node: '>=8'}
@@ -1429,6 +1434,43 @@ packages:
     resolution: {integrity: sha512-dfUnCxiN9H4ap84DvD2ubjw+3vUNpstxa0TneY/Paat8a3R4uQZDLSvWjmznAY/DoahqTHl9V46HF/Zs3F29pg==}
     engines: {node: '>= 10.0.0'}
 
+  '@peculiar/asn1-android@2.6.0':
+    resolution: {integrity: sha512-cBRCKtYPF7vJGN76/yG8VbxRcHLPF3HnkoHhKOZeHpoVtbMYfY9ROKtH3DtYUY9m8uI1Mh47PRhHf2hSK3xcSQ==}
+
+  '@peculiar/asn1-cms@2.6.0':
+    resolution: {integrity: sha512-2uZqP+ggSncESeUF/9Su8rWqGclEfEiz1SyU02WX5fUONFfkjzS2Z/F1Li0ofSmf4JqYXIOdCAZqIXAIBAT1OA==}
+
+  '@peculiar/asn1-csr@2.6.0':
+    resolution: {integrity: sha512-BeWIu5VpTIhfRysfEp73SGbwjjoLL/JWXhJ/9mo4vXnz3tRGm+NGm3KNcRzQ9VMVqwYS2RHlolz21svzRXIHPQ==}
+
+  '@peculiar/asn1-ecc@2.6.0':
+    resolution: {integrity: sha512-FF3LMGq6SfAOwUG2sKpPXblibn6XnEIKa+SryvUl5Pik+WR9rmRA3OCiwz8R3lVXnYnyRkSZsSLdml8H3UiOcw==}
+
+  '@peculiar/asn1-pfx@2.6.0':
+    resolution: {integrity: sha512-rtUvtf+tyKGgokHHmZzeUojRZJYPxoD/jaN1+VAB4kKR7tXrnDCA/RAWXAIhMJJC+7W27IIRGe9djvxKgsldCQ==}
+
+  '@peculiar/asn1-pkcs8@2.6.0':
+    resolution: {integrity: sha512-KyQ4D8G/NrS7Fw3XCJrngxmjwO/3htnA0lL9gDICvEQ+GJ+EPFqldcJQTwPIdvx98Tua+WjkdKHSC0/Km7T+lA==}
+
+  '@peculiar/asn1-pkcs9@2.6.0':
+    resolution: {integrity: sha512-b78OQ6OciW0aqZxdzliXGYHASeCvvw5caqidbpQRYW2mBtXIX2WhofNXTEe7NyxTb0P6J62kAAWLwn0HuMF1Fw==}
+
+  '@peculiar/asn1-rsa@2.6.0':
+    resolution: {integrity: sha512-Nu4C19tsrTsCp9fDrH+sdcOKoVfdfoQQ7S3VqjJU6vedR7tY3RLkQ5oguOIB3zFW33USDUuYZnPEQYySlgha4w==}
+
+  '@peculiar/asn1-schema@2.6.0':
+    resolution: {integrity: sha512-xNLYLBFTBKkCzEZIw842BxytQQATQv+lDTCEMZ8C196iJcJJMBUZxrhSTxLaohMyKK8QlzRNTRkUmanucnDSqg==}
+
+  '@peculiar/asn1-x509-attr@2.6.0':
+    resolution: {integrity: sha512-MuIAXFX3/dc8gmoZBkwJWxUWOSvG4MMDntXhrOZpJVMkYX+MYc/rUAU2uJOved9iJEoiUx7//3D8oG83a78UJA==}
+
+  '@peculiar/asn1-x509@2.6.0':
+    resolution: {integrity: sha512-uzYbPEpoQiBoTq0/+jZtpM6Gq6zADBx+JNFP3yqRgziWBxQ/Dt/HcuvRfm9zJTPdRcBqPNdaRHTVwpyiq6iNMA==}
+
+  '@peculiar/x509@1.14.2':
+    resolution: {integrity: sha512-r2w1Hg6pODDs0zfAKHkSS5HLkOLSeburtcgwvlLLWWCixw+MmW3U6kD5ddyvc2Y2YdbGuVwCF2S2ASoU1cFAag==}
+    engines: {node: '>=22.0.0'}
+
   '@phc/format@1.0.0':
     resolution: {integrity: sha512-m7X9U6BG2+J+R1lSOdCiITLLrxm+cWlNI3HUFA92oLO77ObGNzaKdh8pMLqdZcshtkKuV84olNNXDfMc4FezBQ==}
     engines: {node: '>=10'}
@@ -1639,6 +1681,13 @@ packages:
     cpu: [x64]
     os: [win32]
 
+  '@simplewebauthn/browser@13.2.2':
+    resolution: {integrity: sha512-FNW1oLQpTJyqG5kkDg5ZsotvWgmBaC6jCHR7Ej0qUNep36Wl9tj2eZu7J5rP+uhXgHaLk+QQ3lqcw2vS5MX1IA==}
+
+  '@simplewebauthn/server@13.2.2':
+    resolution: {integrity: sha512-HcWLW28yTMGXpwE9VLx9J+N2KEUaELadLrkPEEI9tpI5la70xNEVEsu/C+m3u7uoq4FulLqZQhgBCzR9IZhFpA==}
+    engines: {node: '>=20.0.0'}
+
   '@smithy/abort-controller@4.0.5':
     resolution: {integrity: sha512-jcrqdTQurIrBbUm4W2YdLVMQDoL0sA9DTxYd2s+R/y+2U9NLOP7Xf/YqfSg1FZhlZIYEnvk2mwbyvIfdLEPo8g==}
     engines: {node: '>=18.0.0'}
@@ -2227,6 +2276,10 @@ packages:
   asciinema-player@3.12.1:
     resolution: {integrity: sha512-X4tIjZEIsD7Keeu1cJbrsZZCbPSO85w2OiDRGui68JHQPjthIG2jh68TARDrf2CP2l1Lko4mevnBdwwmJfD0iw==}
 
+  asn1js@3.0.7:
+    resolution: {integrity: sha512-uLvq6KJu04qoQM6gvBfKFjlh6Gl0vOKQuR5cJMDHQkmwfMOQeN3F3SHCv9SNYSL+CRoHvOGFfllDlVz03GQjvQ==}
+    engines: {node: '>=12.0.0'}
+
   ast-types-flow@0.0.8:
     resolution: {integrity: sha512-OH/2E5Fg20h2aPrbe+QL8JZQFko0YZaF+j4mnQ7BGhfavO7OpSLa8a0y9sBwomHdSbkhTS8TQNayBfnW5DwbvQ==}
 
@@ -4143,6 +4196,13 @@ packages:
   pure-rand@6.1.0:
     resolution: {integrity: sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==}
 
+  pvtsutils@1.3.6:
+    resolution: {integrity: sha512-PLgQXQ6H2FWCaeRak8vvk1GW462lMxB5s3Jm673N82zI4vqtVUPuZdffdZbPDFRoU8kAhItWFtPCWiPpp4/EDg==}
+
+  pvutils@1.1.5:
+    resolution: {integrity: sha512-KTqnxsgGiQ6ZAzZCVlJH5eOjSnvlyEgx1m8bkRJfOhmGRqfo5KLvmAlACQkrjEtOQ4B7wF9TdSLIs9O90MX9xA==}
+    engines: {node: '>=16.0.0'}
+
   qrcode@1.5.4:
     resolution: {integrity: sha512-1ca71Zgiu6ORjHqFBDpnSMTR2ReToX4l1Au1VFLyVeBTFavzQnv5JxMFr3ukHVKpSrSA2MCk0lNJSykjUfz7Zg==}
     engines: {node: '>=10.13.0'}
@@ -4314,6 +4374,9 @@ packages:
       react: ^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
+  reflect-metadata@0.2.2:
+    resolution: {integrity: sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q==}
+
   reflect.getprototypeof@1.0.10:
     resolution: {integrity: sha512-00o4I+DVrefhv+nX0ulyi3biSHCPDe+yLv5o/p6d/UVlirijB8E16FtfwSAi4g3tcqrQ4lRAqQSoFEZJehYEcw==}
     engines: {node: '>= 0.4'}
@@ -4749,6 +4812,9 @@ packages:
     engines: {node: '>=16.20.2'}
     hasBin: true
 
+  tslib@1.14.1:
+    resolution: {integrity: sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==}
+
   tslib@2.8.1:
     resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
 
@@ -4776,6 +4842,10 @@ packages:
     engines: {node: '>=18.0.0'}
     hasBin: true
 
+  tsyringe@4.10.0:
+    resolution: {integrity: sha512-axr3IdNuVIxnaK5XGEUFTu3YmAQ6lllgrvqfEoR16g/HGnYY/6We4oWENtAnzK6/LpJ2ur9PAb80RBt7/U4ugw==}
+    engines: {node: '>= 6.0.0'}
+
   type-check@0.4.0:
     resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
     engines: {node: '>= 0.8.0'}
@@ -6153,7 +6223,7 @@ snapshots:
 
   '@floating-ui/utils@0.2.10': {}
 
-  '@github/webauthn-json@2.1.1': {}
+  '@hexagon/base64@1.1.28': {}
 
   '@humanfs/core@0.19.1': {}
 
@@ -6296,6 +6366,8 @@ snapshots:
       '@jridgewell/resolve-uri': 3.1.2
       '@jridgewell/sourcemap-codec': 1.5.5
 
+  '@levischuck/tiny-cbor@0.2.11': {}
+
   '@lukeed/ms@2.0.2': {}
 
   '@mantine/charts@8.3.9(@mantine/core@8.3.9(@mantine/hooks@8.3.9(react@19.2.1))(@types/react@19.2.7)(react-dom@19.2.1(react@19.2.1))(react@19.2.1))(@mantine/hooks@8.3.9(react@19.2.1))(react-dom@19.2.1(react@19.2.1))(react@19.2.1)(recharts@2.15.4(react-dom@19.2.1(react@19.2.1))(react@19.2.1))':
@@ -6471,6 +6543,102 @@ snapshots:
       '@parcel/watcher-win32-x64': 2.5.1
     optional: true
 
+  '@peculiar/asn1-android@2.6.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-cms@2.6.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      '@peculiar/asn1-x509-attr': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-csr@2.6.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-ecc@2.6.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-pfx@2.6.0':
+    dependencies:
+      '@peculiar/asn1-cms': 2.6.0
+      '@peculiar/asn1-pkcs8': 2.6.0
+      '@peculiar/asn1-rsa': 2.6.0
+      '@peculiar/asn1-schema': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-pkcs8@2.6.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-pkcs9@2.6.0':
+    dependencies:
+      '@peculiar/asn1-cms': 2.6.0
+      '@peculiar/asn1-pfx': 2.6.0
+      '@peculiar/asn1-pkcs8': 2.6.0
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      '@peculiar/asn1-x509-attr': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-rsa@2.6.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-schema@2.6.0':
+    dependencies:
+      asn1js: 3.0.7
+      pvtsutils: 1.3.6
+      tslib: 2.8.1
+
+  '@peculiar/asn1-x509-attr@2.6.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      asn1js: 3.0.7
+      tslib: 2.8.1
+
+  '@peculiar/asn1-x509@2.6.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.6.0
+      asn1js: 3.0.7
+      pvtsutils: 1.3.6
+      tslib: 2.8.1
+
+  '@peculiar/x509@1.14.2':
+    dependencies:
+      '@peculiar/asn1-cms': 2.6.0
+      '@peculiar/asn1-csr': 2.6.0
+      '@peculiar/asn1-ecc': 2.6.0
+      '@peculiar/asn1-pkcs9': 2.6.0
+      '@peculiar/asn1-rsa': 2.6.0
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      pvtsutils: 1.3.6
+      reflect-metadata: 0.2.2
+      tslib: 2.8.1
+      tsyringe: 4.10.0
+
   '@phc/format@1.0.0': {}
 
   '@pinojs/redact@0.4.0': {}
@@ -6724,6 +6892,19 @@ snapshots:
   '@rollup/rollup-win32-x64-msvc@4.53.3':
     optional: true
 
+  '@simplewebauthn/browser@13.2.2': {}
+
+  '@simplewebauthn/server@13.2.2':
+    dependencies:
+      '@hexagon/base64': 1.1.28
+      '@levischuck/tiny-cbor': 0.2.11
+      '@peculiar/asn1-android': 2.6.0
+      '@peculiar/asn1-ecc': 2.6.0
+      '@peculiar/asn1-rsa': 2.6.0
+      '@peculiar/asn1-schema': 2.6.0
+      '@peculiar/asn1-x509': 2.6.0
+      '@peculiar/x509': 1.14.2
+
   '@smithy/abort-controller@4.0.5':
     dependencies:
       '@smithy/types': 4.3.2
@@ -7531,6 +7712,12 @@ snapshots:
       solid-js: 1.9.10
       solid-transition-group: 0.2.3(solid-js@1.9.10)
 
+  asn1js@3.0.7:
+    dependencies:
+      pvtsutils: 1.3.6
+      pvutils: 1.1.5
+      tslib: 2.8.1
+
   ast-types-flow@0.0.8: {}
 
   async-function@1.0.0: {}
@@ -9782,6 +9969,12 @@ snapshots:
 
   pure-rand@6.1.0: {}
 
+  pvtsutils@1.3.6:
+    dependencies:
+      tslib: 2.8.1
+
+  pvutils@1.1.5: {}
+
   qrcode@1.5.4:
     dependencies:
       dijkstrajs: 1.0.3
@@ -9983,6 +10176,8 @@ snapshots:
       tiny-invariant: 1.3.3
       victory-vendor: 36.9.2
 
+  reflect-metadata@0.2.2: {}
+
   reflect.getprototypeof@1.0.10:
     dependencies:
       call-bind: 1.0.8
@@ -10532,6 +10727,8 @@ snapshots:
       normalize-path: 3.0.0
       plimit-lit: 1.6.1
 
+  tslib@1.14.1: {}
+
   tslib@2.8.1: {}
 
   tsup@8.5.1(jiti@2.5.1)(postcss@8.5.6)(tsx@4.21.0)(typescript@5.9.3):
@@ -10569,6 +10766,10 @@ snapshots:
     optionalDependencies:
       fsevents: 2.3.3
 
+  tsyringe@4.10.0:
+    dependencies:
+      tslib: 1.14.1
+
   type-check@0.4.0:
     dependencies:
       prelude-ls: 1.2.1
diff --git a/prisma/migrations/20260108050615_passkeys_overhaul/migration.sql b/prisma/migrations/20260108050615_passkeys_overhaul/migration.sql
new file mode 100644
index 00000000..572c51df
--- /dev/null
+++ b/prisma/migrations/20260108050615_passkeys_overhaul/migration.sql
@@ -0,0 +1,11 @@
+/*
+  Warnings:
+
+  - You are about to drop the column `mfaPasskeys` on the `Zipline` table. All the data in the column will be lost.
+
+*/
+-- AlterTable
+ALTER TABLE "public"."Zipline" DROP COLUMN "mfaPasskeys",
+ADD COLUMN     "mfaPasskeysEnabled" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "mfaPasskeysOrigin" TEXT,
+ADD COLUMN     "mfaPasskeysRpID" TEXT;
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index ef0312c1..cba98add 100755
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -108,7 +108,10 @@ model Zipline {
 
   mfaTotpEnabled Boolean @default(false)
   mfaTotpIssuer  String  @default("Zipline")
-  mfaPasskeys    Boolean @default(false)
+
+  mfaPasskeysEnabled Boolean @default(false)
+  mfaPasskeysRpID    String?
+  mfaPasskeysOrigin  String?
 
   ratelimitEnabled     Boolean  @default(true)
   ratelimitMax         Int      @default(10)
diff --git a/src/client/pages/auth/login.tsx b/src/client/pages/auth/login.tsx
index d2d8b099..99c07d2b 100644
--- a/src/client/pages/auth/login.tsx
+++ b/src/client/pages/auth/login.tsx
@@ -2,7 +2,7 @@ import ExternalAuthButton from '@/components/pages/login/ExternalAuthButton';
 import { Response } from '@/lib/api/response';
 import { fetchApi } from '@/lib/fetchApi';
 import useLogin from '@/lib/hooks/useLogin';
-import { authenticateWeb } from '@/lib/passkey';
+import { useTitle } from '@/lib/hooks/useTitle';
 import {
   Button,
   Center,
@@ -21,6 +21,7 @@ import {
 } from '@mantine/core';
 import { useForm } from '@mantine/form';
 import { notifications, showNotification } from '@mantine/notifications';
+import { browserSupportsWebAuthn, startAuthentication } from '@simplewebauthn/browser';
 import {
   IconBrandDiscordFilled,
   IconBrandGithubFilled,
@@ -35,7 +36,6 @@ import { useEffect, useState } from 'react';
 import { Link, useLocation, useNavigate } from 'react-router-dom';
 import useSWR from 'swr';
 import GenericError from '../../error/GenericError';
-import { useTitle } from '@/lib/hooks/useTitle';
 
 export default function Login() {
   useTitle('Login');
@@ -128,9 +128,24 @@ export default function Login() {
   const handlePasskeyLogin = async () => {
     try {
       setPasskeyLoading(true);
-      const res = await authenticateWeb();
+      const { data: options, error: optionsError } = await fetchApi<Response['/api/auth/webauthn/options']>(
+        '/api/auth/webauthn/options',
+        'GET',
+      );
+      if (optionsError) {
+        setPasskeyErrored(true);
+        setPasskeyLoading(false);
+        notifications.show({
+          title: 'Error while authenticating with passkey',
+          message: optionsError.error,
+          color: 'red',
+        });
+        return;
+      }
+
+      const res = await startAuthentication({ optionsJSON: options!.options! });
       const { data, error } = await fetchApi<Response['/api/auth/webauthn']>('/api/auth/webauthn', 'POST', {
-        auth: res.toJSON(),
+        response: res,
       });
       if (error) {
         setPasskeyErrored(true);
@@ -336,7 +351,7 @@ export default function Login() {
               <Divider label='or' />
             )}
 
-            {config.mfa.passkeys && (
+            {config.mfa.passkeys && browserSupportsWebAuthn() && (
               <Button
                 onClick={handlePasskeyLogin}
                 size='md'
diff --git a/src/components/pages/serverSettings/parts/Mfa.tsx b/src/components/pages/serverSettings/parts/Mfa.tsx
index d5ea28eb..d7e97630 100644
--- a/src/components/pages/serverSettings/parts/Mfa.tsx
+++ b/src/components/pages/serverSettings/parts/Mfa.tsx
@@ -17,7 +17,9 @@ export default function Mfa({
     initialValues: {
       mfaTotpEnabled: false,
       mfaTotpIssuer: 'Zipline',
-      mfaPasskeys: false,
+      mfaPasskeysEnabled: false,
+      mfaPasskeysRpID: '',
+      mfaPasskeysOrigin: '',
     },
     enhanceGetInputProps: (payload) => ({
       disabled: data?.tampered?.includes(payload.field) || false,
@@ -32,7 +34,9 @@ export default function Mfa({
     form.setValues({
       mfaTotpEnabled: data.settings.mfaTotpEnabled ?? false,
       mfaTotpIssuer: data.settings.mfaTotpIssuer ?? 'Zipline',
-      mfaPasskeys: data.settings.mfaPasskeys,
+      mfaPasskeysEnabled: data.settings.mfaPasskeysEnabled ?? false,
+      mfaPasskeysRpID: data.settings.mfaPasskeysRpID ?? '',
+      mfaPasskeysOrigin: data.settings.mfaPasskeysOrigin ?? '',
     });
   }, [data]);
 
@@ -47,7 +51,21 @@ export default function Mfa({
           <Switch
             label='Passkeys'
             description='Enable the use of passwordless login with the use of WebAuthn passkeys like your phone, security keys, etc.'
-            {...form.getInputProps('mfaPasskeys', { type: 'checkbox' })}
+            {...form.getInputProps('mfaPasskeysEnabled', { type: 'checkbox' })}
+          />
+
+          <TextInput
+            label='Relying Party ID'
+            description='The Relying Party ID (RP ID) to use for WebAuthn passkeys.'
+            placeholder='example.com'
+            {...form.getInputProps('mfaPasskeysRpID')}
+          />
+
+          <TextInput
+            label='Origin'
+            description='The Origin to use for WebAuthn passkeys.'
+            placeholder='https://example.com'
+            {...form.getInputProps('mfaPasskeysOrigin')}
           />
 
           <Switch
diff --git a/src/components/pages/settings/parts/SettingsMfa/PasskeyButton.tsx b/src/components/pages/settings/parts/SettingsMfa/PasskeyButton.tsx
index 6e389ce2..6f479c30 100755
--- a/src/components/pages/settings/parts/SettingsMfa/PasskeyButton.tsx
+++ b/src/components/pages/settings/parts/SettingsMfa/PasskeyButton.tsx
@@ -1,12 +1,15 @@
 import RelativeDate from '@/components/RelativeDate';
 import { fetchApi } from '@/lib/fetchApi';
-import { registerWeb } from '@/lib/passkey';
 import { useUserStore } from '@/lib/store/user';
-import { RegistrationResponseJSON } from '@github/webauthn-json/dist/types/browser-ponyfill';
+import { UserPasskey } from '@/prisma/client';
 import { ActionIcon, Button, Group, Modal, Paper, Stack, Text, TextInput } from '@mantine/core';
 import { modals } from '@mantine/modals';
 import { notifications } from '@mantine/notifications';
-import { UserPasskey } from '@/prisma/client';
+import {
+  PublicKeyCredentialCreationOptionsJSON,
+  RegistrationResponseJSON,
+  startRegistration,
+} from '@simplewebauthn/browser';
 import { IconKey, IconKeyOff, IconTrashFilled } from '@tabler/icons-react';
 import { useEffect, useState } from 'react';
 import { mutate } from 'swr';
@@ -19,14 +22,21 @@ export default function PasskeyButton() {
   const [passkeyLoading, setPasskeyLoading] = useState(false);
   const [namerShown, setNamerShown] = useState(false);
   const [savedKey, setSavedKey] = useState<RegistrationResponseJSON | null>(null);
+  const [options, setOptions] = useState<PublicKeyCredentialCreationOptionsJSON | null>(null);
   const [name, setName] = useState('');
 
   const handleRegisterPasskey = async () => {
     try {
+      const { data } = await fetchApi<PublicKeyCredentialCreationOptionsJSON>(
+        '/api/user/mfa/passkey/options',
+        'GET',
+      );
+
       setPasskeyLoading(true);
-      const res = await registerWeb(user!);
+      const res = await startRegistration({ optionsJSON: data! });
       setNamerShown(true);
-      setSavedKey(res.toJSON());
+      setSavedKey(res);
+      setOptions(data);
     } catch (e: any) {
       setPasskeyError(e.message ?? 'An error occurred while creating a passkey');
       setPasskeyLoading(false);
@@ -38,7 +48,7 @@ export default function PasskeyButton() {
     if (!savedKey) return;
 
     const { error } = await fetchApi('/api/user/mfa/passkey', 'POST', {
-      reg: savedKey,
+      response: savedKey,
       name: name.trim(),
     });
 
diff --git a/src/components/pages/settings/parts/SettingsMfa/index.tsx b/src/components/pages/settings/parts/SettingsMfa/index.tsx
index 62b7595b..ea7c445e 100755
--- a/src/components/pages/settings/parts/SettingsMfa/index.tsx
+++ b/src/components/pages/settings/parts/SettingsMfa/index.tsx
@@ -15,7 +15,7 @@ export default function SettingsMfa() {
 
       <Group mt='xs'>
         {config.mfa.totp.enabled && <TwoFAButton />}
-        {config.mfa.passkeys && <PasskeyButton />}
+        {config.mfa.passkeys.enabled && <PasskeyButton />}
       </Group>
     </Paper>
   );
diff --git a/src/lib/api/response.ts b/src/lib/api/response.ts
index 8fe97ff0..99c1c8ac 100755
--- a/src/lib/api/response.ts
+++ b/src/lib/api/response.ts
@@ -5,7 +5,7 @@ import { ApiLoginResponse } from '@/server/routes/api/auth/login';
 import { ApiLogoutResponse } from '@/server/routes/api/auth/logout';
 import { ApiAuthOauthResponse } from '@/server/routes/api/auth/oauth';
 import { ApiAuthRegisterResponse } from '@/server/routes/api/auth/register';
-import { ApiAuthWebauthnResponse } from '@/server/routes/api/auth/webauthn';
+import { ApiAuthWebauthnOptionsResponse, ApiAuthWebauthnResponse } from '@/server/routes/api/auth/webauthn';
 import { ApiHealthcheckResponse } from '@/server/routes/api/healthcheck';
 import { ApiServerClearTempResponse } from '@/server/routes/api/server/clear_temp';
 import { ApiServerClearZerosResponse } from '@/server/routes/api/server/clear_zeros';
@@ -50,6 +50,7 @@ export type Response = {
   '/api/auth/invites/web': ApiAuthInvitesWebResponse;
   '/api/auth/register': ApiAuthRegisterResponse;
   '/api/auth/webauthn': ApiAuthWebauthnResponse;
+  '/api/auth/webauthn/options': ApiAuthWebauthnOptionsResponse;
   '/api/auth/oauth': ApiAuthOauthResponse;
   '/api/auth/login': ApiLoginResponse;
   '/api/auth/logout': ApiLogoutResponse;
diff --git a/src/lib/config/index.ts b/src/lib/config/index.ts
index aedba36e..0b02171f 100755
--- a/src/lib/config/index.ts
+++ b/src/lib/config/index.ts
@@ -1,15 +1,36 @@
+import { readFile } from 'fs/promises';
 import { read } from './read';
 import { validateConfigObject, Config } from './validate';
+import { log } from '../logger';
+
+type CachedConfig = {
+  tos: string | null;
+};
 
 let config: Config;
 
 declare global {
   var __config__: Config;
   var __tamperedConfig__: string[];
+
+  var __cachedConfigValues__: Partial<CachedConfig>;
 }
 
 const reloadSettings = async () => {
   config = global.__config__ = validateConfigObject((await read()) as any);
+
+  if (!global.__cachedConfigValues__) {
+    global.__cachedConfigValues__ = {};
+
+    if (config.website.tos) {
+      try {
+        const tos = await readFile(config.website.tos, 'utf-8');
+        global.__cachedConfigValues__.tos = tos;
+      } catch {
+        log('config').error('failed to read tos', { path: config.website.tos });
+      }
+    }
+  }
 };
 
 config = global.__config__;
diff --git a/src/lib/config/read/db.ts b/src/lib/config/read/db.ts
index 3f96675b..2fc04c17 100644
--- a/src/lib/config/read/db.ts
+++ b/src/lib/config/read/db.ts
@@ -96,7 +96,9 @@ export const DATABASE_TO_PROP = {
 
   mfaTotpEnabled: 'mfa.totp.enabled',
   mfaTotpIssuer: 'mfa.totp.issuer',
-  mfaPasskeys: 'mfa.passkeys',
+  mfaPasskeysEnabled: 'mfa.passkeys.enabled',
+  mfaPasskeysRpID: 'mfa.passkeys.rpID',
+  mfaPasskeysOrigin: 'mfa.passkeys.origin',
 
   ratelimitEnabled: 'ratelimit.enabled',
   ratelimitMax: 'ratelimit.max',
diff --git a/src/lib/config/read/env.ts b/src/lib/config/read/env.ts
index b861bdc4..cb3f2fb3 100644
--- a/src/lib/config/read/env.ts
+++ b/src/lib/config/read/env.ts
@@ -131,7 +131,9 @@ export const ENVS = [
 
   env('mfa.totp.enabled', 'MFA_TOTP_ENABLED', 'boolean', true),
   env('mfa.totp.issuer', 'MFA_TOTP_ISSUER', 'string', true),
-  env('mfa.passkeys', 'MFA_PASSKEYS', 'boolean', true),
+  env('mfa.passkeys.enabled', 'MFA_PASSKEYS_ENABLED', 'boolean', true),
+  env('mfa.passkeys.rpID', 'MFA_PASSKEYS_RP_ID', 'string', true),
+  env('mfa.passkeys.origin', 'MFA_PASSKEYS_ORIGIN', 'string', true),
 
   env('ratelimit.enabled', 'RATELIMIT_ENABLED', 'boolean', true),
   env('ratelimit.max', 'RATELIMIT_MAX', 'number', true),
diff --git a/src/lib/config/read/index.ts b/src/lib/config/read/index.ts
index 11367665..f77896da 100755
--- a/src/lib/config/read/index.ts
+++ b/src/lib/config/read/index.ts
@@ -96,7 +96,11 @@ export const rawConfig: any = {
       enabled: undefined,
       issuer: undefined,
     },
-    passkeys: undefined,
+    passkeys: {
+      enabled: undefined,
+      rpID: undefined,
+      origin: undefined,
+    },
   },
   oauth: {
     bypassLocalLogin: undefined,
diff --git a/src/lib/config/validate.ts b/src/lib/config/validate.ts
index c93c28f5..e1f99536 100755
--- a/src/lib/config/validate.ts
+++ b/src/lib/config/validate.ts
@@ -244,7 +244,11 @@ export const schema = z.object({
       enabled: z.boolean().default(false),
       issuer: z.string().default('Zipline'),
     }),
-    passkeys: z.boolean().default(true),
+    passkeys: z.object({
+      enabled: z.boolean().default(false),
+      rpID: z.string().nullable().default(null),
+      origin: z.url().nullable().default(null),
+    }),
   }),
   oauth: z.object({
     bypassLocalLogin: z.boolean().default(false),
diff --git a/src/lib/passkey.ts b/src/lib/passkey.ts
deleted file mode 100755
index b4ebc4d3..00000000
--- a/src/lib/passkey.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-import {
-  parseCreationOptionsFromJSON,
-  parseRequestOptionsFromJSON,
-  create,
-  get,
-} from '@github/webauthn-json/browser-ponyfill';
-import { User } from './db/models/user';
-import { randomCharacters } from './random';
-
-export async function registerWeb(user: User) {
-  const cro = parseCreationOptionsFromJSON({
-    publicKey: {
-      challenge: randomCharacters(64),
-      rp: { name: 'Zipline' },
-      user: {
-        id: randomCharacters(64),
-        name: user.username,
-        displayName: user.username,
-      },
-      pubKeyCredParams: [],
-      authenticatorSelection: {
-        userVerification: 'preferred',
-        authenticatorAttachment: 'cross-platform',
-        requireResidentKey: true,
-      },
-    },
-  });
-
-  return create(cro);
-}
-
-export async function authenticateWeb() {
-  const cro = parseRequestOptionsFromJSON({
-    publicKey: {
-      challenge: randomCharacters(64),
-    },
-  });
-
-  return get(cro);
-}
diff --git a/src/lib/timedCache.ts b/src/lib/timedCache.ts
new file mode 100644
index 00000000..d163f74e
--- /dev/null
+++ b/src/lib/timedCache.ts
@@ -0,0 +1,49 @@
+type CacheEntry<T> = {
+  value: T;
+  expiresAt: number;
+  timeout: NodeJS.Timeout;
+};
+
+export class TimedCache<K, V> {
+  private cache = new Map<K, CacheEntry<V>>();
+  private ttl: number;
+
+  constructor(ttl = 60_000) {
+    this.ttl = ttl;
+  }
+
+  set(key: K, value: V, ttl = this.ttl): void {
+    const expiresAt = Date.now() + ttl;
+
+    const existing = this.cache.get(key);
+    if (existing) clearTimeout(existing.timeout);
+
+    const timeout = setTimeout(() => this.cache.delete(key), ttl);
+    timeout.unref?.();
+
+    this.cache.set(key, { value, expiresAt, timeout });
+  }
+
+  get(key: K): V | undefined {
+    const entry = this.cache.get(key);
+    if (!entry) return undefined;
+
+    if (entry.expiresAt <= Date.now()) {
+      this.delete(key);
+      return undefined;
+    }
+
+    return entry.value;
+  }
+
+  has(key: K): boolean {
+    return this.get(key) !== undefined;
+  }
+
+  delete(key: K): boolean {
+    const entry = this.cache.get(key);
+    if (entry) clearTimeout(entry.timeout);
+
+    return this.cache.delete(key);
+  }
+}
diff --git a/src/server/routes/api/auth/login.ts b/src/server/routes/api/auth/login.ts
index 178846b0..70352f91 100755
--- a/src/server/routes/api/auth/login.ts
+++ b/src/server/routes/api/auth/login.ts
@@ -45,8 +45,8 @@ export default fastifyPlugin(
         },
       });
       if (!user) return res.badRequest('Invalid username or password');
+      if (!user.password) return res.badRequest('Invalid username or password');
 
-      if (!user.password) return res.badRequest('User does not have a password, login through a provider');
       const valid = await verifyPassword(password, user.password);
       if (!valid) {
         logger.warn('invalid login attempt', {
@@ -54,6 +54,7 @@ export default fastifyPlugin(
           ip: req.ip ?? 'unknown',
           ua: req.headers['user-agent'],
         });
+
         return res.badRequest('Invalid username or password');
       }
 
diff --git a/src/server/routes/api/auth/webauthn.ts b/src/server/routes/api/auth/webauthn.ts
index e8a536ee..e8fb6e84 100755
--- a/src/server/routes/api/auth/webauthn.ts
+++ b/src/server/routes/api/auth/webauthn.ts
@@ -1,84 +1,186 @@
 import { config } from '@/lib/config';
+import { createToken } from '@/lib/crypto';
 import { prisma } from '@/lib/db';
 import { User, userSelect } from '@/lib/db/models/user';
 import { log } from '@/lib/logger';
+import { secondlyRatelimit } from '@/lib/ratelimits';
+import { TimedCache } from '@/lib/timedCache';
 import { getSession, saveSession } from '@/server/session';
-import { AuthenticationResponseJSON } from '@github/webauthn-json/dist/types/browser-ponyfill';
+import { JsonObject } from '@prisma/client/runtime/client';
+import { AuthenticationResponseJSON } from '@simplewebauthn/browser';
+import {
+  generateAuthenticationOptions,
+  PublicKeyCredentialRequestOptionsJSON,
+  verifyAuthenticationResponse,
+} from '@simplewebauthn/server';
 import fastifyPlugin from 'fastify-plugin';
+import { PasskeyReg, passkeysEnabledHandler } from '../user/mfa/passkey';
 
 export type ApiAuthWebauthnResponse = {
   user: User;
 };
 
+export type ApiAuthWebauthnOptionsResponse = {
+  id: string;
+  options: PublicKeyCredentialRequestOptionsJSON;
+};
+
 type Body = {
-  auth: AuthenticationResponseJSON;
+  response: AuthenticationResponseJSON;
 };
 
 const logger = log('api').c('auth').c('webauthn');
 
+const OPTIONS_CACHE = new TimedCache<string, PublicKeyCredentialRequestOptionsJSON>(2 * 60_000);
+
 export const PATH = '/api/auth/webauthn';
 export default fastifyPlugin(
   (server, _, done) => {
-    server.post<{ Body: Body }>(PATH, async (req, res) => {
-      const session = await getSession(req, res);
-      if (!config.mfa.passkeys) return res.badRequest('Passkeys are not enabled');
+    server.get(
+      PATH + '/options',
+      { preHandler: [passkeysEnabledHandler], ...secondlyRatelimit(20) },
+      async (req, res) => {
+        if (req.cookies['webauthn-challenge-id']) {
+          const existing = OPTIONS_CACHE.get(req.cookies['webauthn-challenge-id']);
+          if (existing)
+            return res.send({
+              id: req.cookies['webauthn-challenge-id'],
+              options: existing,
+            });
+        }
 
-      const { auth } = req.body;
-      if (!auth) return res.badRequest('Missing webauthn payload');
+        const options = await generateAuthenticationOptions({
+          rpID: config.mfa.passkeys.rpID!,
+          userVerification: 'preferred',
+        });
 
-      const user = await prisma.user.findFirst({
-        where: {
-          passkeys: {
-            some: {
-              reg: {
-                path: ['id'],
-                equals: auth.id,
+        const id = createToken();
+        res.setCookie('webauthn-challenge-id', id, {
+          expires: new Date(Date.now() + 2 * 60_000),
+          httpOnly: true,
+          secure: config.core.returnHttpsUrls,
+          sameSite: 'lax',
+        });
+        OPTIONS_CACHE.set(id, options);
+
+        return res.send({
+          id,
+          options,
+        });
+      },
+    );
+
+    server.post<{ Body: Body }>(
+      PATH,
+      { preHandler: [passkeysEnabledHandler], ...secondlyRatelimit(10) },
+      async (req, res) => {
+        const session = await getSession(req, res);
+
+        const webauthnChallengeId = req.cookies['webauthn-challenge-id'];
+        if (!webauthnChallengeId) return res.badRequest('Missing webauthn challenge id');
+
+        const { response } = req.body;
+        if (!response) return res.badRequest('Missing webauthn payload');
+
+        const cachedOptions = OPTIONS_CACHE.get(webauthnChallengeId);
+        if (!cachedOptions) return res.badRequest();
+
+        const user = await prisma.user.findFirst({
+          where: {
+            passkeys: {
+              some: {
+                reg: {
+                  path: ['webauthn', 'id'],
+                  equals: response.id,
+                },
               },
             },
           },
-        },
-        select: {
-          ...userSelect,
-          password: true,
-          token: true,
-        },
-      });
-      if (!user) {
-        logger.warn('invalid webauthn attempt', {
-          id: auth.id,
-        });
-        logger.debug('invalid webauthn attempt', {
-          request: auth,
-        });
-
-        return res.badRequest('Invalid passkey');
-      }
-
-      await saveSession(session, user, false);
-
-      delete (user as any).password;
-
-      await prisma.userPasskey.updateMany({
-        where: {
-          reg: {
-            path: ['id'],
-            equals: auth.id,
+          select: {
+            ...userSelect,
+            password: true,
+            token: true,
           },
-        },
-        data: {
-          lastUsed: new Date(),
-        },
-      });
+        });
+        if (!user) {
+          logger.warn('invalid webauthn attempt', {
+            req: webauthnChallengeId,
+          });
+          logger.debug('invalid webauthn attempt', {
+            request: response,
+          });
 
-      logger.info('user logged in with passkey', {
-        user: user.username,
-        passkey: auth.id,
-      });
+          return res.badRequest();
+        }
 
-      return res.send({
-        user,
-      });
-    });
+        const passkey = user.passkeys.find((pk) => {
+          const webauthn = (pk?.reg as JsonObject).webauthn as { id: string };
+          if (!webauthn) return false;
+          return webauthn.id === response.id;
+        });
+
+        if (!passkey) return res.badRequest();
+        const reg = passkey.reg as PasskeyReg;
+
+        if (!reg.webauthn) {
+          logger.debug('invalid webauthn attempt, legacy passkey found...');
+          return res.badRequest();
+        }
+
+        OPTIONS_CACHE.delete(webauthnChallengeId);
+
+        let verification;
+        try {
+          verification = await verifyAuthenticationResponse({
+            response: response,
+            expectedChallenge: cachedOptions.challenge,
+            expectedRPID: cachedOptions.rpId!,
+            expectedOrigin: config.mfa.passkeys.origin!,
+            credential: {
+              id: reg.webauthn.id,
+              counter: reg.webauthn.counter,
+              publicKey: new Uint8Array(Buffer.from(reg.webauthn.publicKey, 'base64')),
+            },
+          });
+        } catch (e) {
+          console.error(e);
+          logger.warn('error verifying passkey authentication');
+          return res.badRequest('Error verifying passkey authentication');
+        }
+
+        if (!verification.verified) {
+          logger.warn('failed passkey authentication attempt', {
+            user: user.username,
+          });
+          return res.badRequest('Could not verify passkey authentication');
+        }
+
+        const { newCounter } = verification.authenticationInfo;
+
+        await saveSession(session, user, false);
+
+        delete (user as any).password;
+
+        await prisma.userPasskey.update({
+          where: {
+            id: passkey.id,
+          },
+          data: {
+            lastUsed: new Date(),
+            reg: { webauthn: { ...reg.webauthn, counter: newCounter } },
+          },
+        });
+
+        logger.info('user logged in with passkey', {
+          user: user.username,
+          passkey: passkey.name,
+        });
+
+        return res.send({
+          user,
+        });
+      },
+    );
 
     done();
   },
diff --git a/src/server/routes/api/server/public.ts b/src/server/routes/api/server/public.ts
index 50bfdb16..a8326702 100644
--- a/src/server/routes/api/server/public.ts
+++ b/src/server/routes/api/server/public.ts
@@ -1,10 +1,9 @@
 import { config } from '@/lib/config';
 import { Config } from '@/lib/config/validate';
 import { getZipline } from '@/lib/db/models/zipline';
-import { log } from '@/lib/logger';
 import enabled from '@/lib/oauth/enabled';
+import { isTruthy } from '@/lib/primitive';
 import fastifyPlugin from 'fastify-plugin';
-import { readFile } from 'fs/promises';
 
 export type ApiServerPublicResponse = {
   oauth: {
@@ -44,14 +43,10 @@ export type ApiServerPublicResponse = {
   domains?: string[];
 };
 
-const logger = log('api').c('server').c('public');
-
-let tosCache: string | null = null;
-
 export const PATH = '/api/server/public';
 export default fastifyPlugin(
   (server, _, done) => {
-    server.get<{ Body: Body }>(PATH, async (req, res) => {
+    server.get<{ Body: Body }>(PATH, async (_, res) => {
       const zipline = await getZipline();
 
       const response: ApiServerPublicResponse = {
@@ -71,7 +66,11 @@ export default fastifyPlugin(
           userRegistration: config.features.userRegistration,
         },
         mfa: {
-          passkeys: config.mfa.passkeys,
+          passkeys: isTruthy(
+            config.mfa.passkeys.enabled,
+            config.mfa.passkeys.rpID,
+            config.mfa.passkeys.origin,
+          ),
         },
         files: {
           maxFileSize: config.files.maxFileSize,
@@ -88,15 +87,7 @@ export default fastifyPlugin(
       }
 
       if (config.website.tos) {
-        try {
-          if (tosCache === null) {
-            const tos = await readFile(config.website.tos, 'utf8');
-            tosCache = tos;
-          }
-          response.tos = tosCache;
-        } catch {
-          response.tos = null;
-        }
+        response.tos = global.__cachedConfigValues__.tos!;
       }
 
       return res.send(response);
diff --git a/src/server/routes/api/server/settings/index.ts b/src/server/routes/api/server/settings/index.ts
index 2970638e..623fdcda 100644
--- a/src/server/routes/api/server/settings/index.ts
+++ b/src/server/routes/api/server/settings/index.ts
@@ -37,6 +37,16 @@ export const reservedRoutes = [
   '/favicon.ico',
 ];
 
+const jsonTransform = (value: any, ctx: z.RefinementCtx) => {
+  if (typeof value !== 'string') return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    ctx.addIssue({ code: 'custom', message: 'Invalid JSON' });
+    return z.NEVER;
+  }
+};
+
 const zMs = z.string().refine((value) => ms(value as StringValue) > 0, 'Value must be greater than 0');
 const zBytes = z.string().refine((value) => bytes(value) > 0, 'Value must be greater than 0');
 
@@ -61,7 +71,7 @@ const discordEmbed = z
     z.string(),
   ])
   .nullable()
-  .transform((value) => (typeof value === 'string' ? JSON.parse(value) : value))
+  .transform(jsonTransform)
   .transform((value) =>
     typeof value === 'object' ? (Object.keys(value || {}).length ? value : null) : value,
   );
@@ -208,7 +218,7 @@ export default fastifyPlugin(
                 ),
                 z.string(),
               ])
-              .transform((value) => (typeof value === 'string' ? JSON.parse(value) : value)),
+              .transform(jsonTransform),
             websiteLoginBackground: z.url().nullable(),
             websiteLoginBackgroundBlur: z.boolean(),
             websiteDefaultAvatar: z
@@ -282,7 +292,9 @@ export default fastifyPlugin(
 
             mfaTotpEnabled: z.boolean(),
             mfaTotpIssuer: z.string(),
-            mfaPasskeys: z.boolean(),
+            mfaPasskeysEnabled: z.boolean(),
+            mfaPasskeysRpID: z.string(),
+            mfaPasskeysOrigin: z.string(),
 
             ratelimitEnabled: z.boolean(),
             ratelimitMax: z.number().refine((value) => value > 0, 'Value must be greater than 0'),
diff --git a/src/server/routes/api/user/mfa/passkey.ts b/src/server/routes/api/user/mfa/passkey.ts
index 9b7683a6..7248899f 100755
--- a/src/server/routes/api/user/mfa/passkey.ts
+++ b/src/server/routes/api/user/mfa/passkey.ts
@@ -2,17 +2,26 @@ import { config } from '@/lib/config';
 import { prisma } from '@/lib/db';
 import { User } from '@/lib/db/models/user';
 import { log } from '@/lib/logger';
+import { isTruthy } from '@/lib/primitive';
 import { secondlyRatelimit } from '@/lib/ratelimits';
+import { TimedCache } from '@/lib/timedCache';
+import { Prisma } from '@/prisma/client';
 import { userMiddleware } from '@/server/middleware/user';
-import { RegistrationResponseJSON } from '@github/webauthn-json/dist/types/browser-ponyfill';
+import {
+  AuthenticatorTransportFuture,
+  generateRegistrationOptions,
+  PublicKeyCredentialCreationOptionsJSON,
+  PublicKeyCredentialDescriptorJSON,
+  RegistrationResponseJSON,
+  verifyRegistrationResponse,
+} from '@simplewebauthn/server';
 import { FastifyReply, FastifyRequest } from 'fastify';
 import fastifyPlugin from 'fastify-plugin';
-import { Prisma } from '@/prisma/client';
 
 export type ApiUserMfaPasskeyResponse = User | User['passkeys'];
 
 type Body = {
-  reg?: RegistrationResponseJSON;
+  response: RegistrationResponseJSON;
   name?: string;
 
   id?: string;
@@ -20,21 +29,88 @@ type Body = {
 
 const logger = log('api').c('user').c('mfa').c('passkey');
 
-const passkeysEnabledHandler = (_: FastifyRequest, res: FastifyReply, done: () => void) => {
-  if (!config.mfa.passkeys) {
-    return res.badRequest('Passkeys are not enabled');
-  }
+const passkeysEnabled = (): boolean =>
+  isTruthy(config.mfa.passkeys.enabled, config.mfa.passkeys.rpID, config.mfa.passkeys.origin);
+
+export const passkeysEnabledHandler = (_: FastifyRequest, res: FastifyReply, done: () => void) => {
+  if (!passkeysEnabled()) return res.notFound();
 
   done();
 };
 
+export type PasskeyReg = {
+  webauthn: {
+    webAuthnUserID: string;
+    id: string;
+    publicKey: string;
+    counter: number;
+    transports?: string[];
+    deviceType?: string;
+    backedUp?: boolean;
+  };
+};
+
+const OPTIONS_CACHE = new TimedCache<string, PublicKeyCredentialCreationOptionsJSON>(3 * 60_000); // 3 min ttl
+
 export const PATH = '/api/user/mfa/passkey';
 export default fastifyPlugin(
   (server, _, done) => {
     server.get(PATH, { preHandler: [userMiddleware, passkeysEnabledHandler] }, async (req, res) => {
-      return res.send(req.user.passkeys);
+      const passkeys = await prisma.userPasskey.findMany({
+        where: {
+          userId: req.user.id,
+        },
+        omit: {
+          reg: true,
+        },
+      });
+
+      return res.send(passkeys);
     });
 
+    server.get(
+      PATH + '/options',
+      { preHandler: [userMiddleware, passkeysEnabledHandler], ...secondlyRatelimit(1) },
+      async (req, res) => {
+        if (OPTIONS_CACHE.has(req.user.id)) return res.send(OPTIONS_CACHE.get(req.user.id)!);
+
+        const existingPasskeys = (await prisma.userPasskey.findMany({
+          where: { userId: req.user.id },
+          select: {
+            reg: true,
+          },
+        })) as { reg: PasskeyReg | null }[];
+
+        const options: PublicKeyCredentialCreationOptionsJSON = await generateRegistrationOptions({
+          rpName: 'Zipline',
+          rpID: config.mfa.passkeys.rpID!,
+
+          userName: req.user.username,
+          userID: new TextEncoder().encode(req.user.id),
+
+          authenticatorSelection: {
+            userVerification: 'preferred',
+            residentKey: 'preferred',
+          },
+
+          excludeCredentials: existingPasskeys
+            .filter((pk) => pk.reg?.webauthn && pk.reg.webauthn.id)
+            .map(
+              (pk) =>
+                ({
+                  id: pk.reg!.webauthn.id,
+                  type: 'public-key',
+                  transports: (pk.reg!.webauthn!.transports as AuthenticatorTransportFuture[]) ?? undefined,
+                }) satisfies PublicKeyCredentialDescriptorJSON,
+            ),
+        });
+
+        OPTIONS_CACHE.set(req.user.id, options);
+
+        return res.send(options);
+      },
+    );
+
     server.post<{ Body: Body }>(
       PATH,
       {
@@ -42,17 +118,50 @@ export default fastifyPlugin(
         ...secondlyRatelimit(1),
       },
       async (req, res) => {
-        const { reg, name } = req.body;
-        if (!reg) return res.badRequest('Missing webauthn response');
-        if (!name) return res.badRequest('Missing name');
+        const { response, name } = req.body;
+        if (!response) return res.badRequest('Missing webauthn response');
+
+        const normalizedName = (name ?? '').trim();
+        if (normalizedName.length === 0) return res.badRequest('Passkey name cannot be empty');
+
+        const optionsCached = OPTIONS_CACHE.get(req.user.id);
+        if (!optionsCached) return res.badRequest('passkey registration timed out, try again later');
+
+        OPTIONS_CACHE.delete(req.user.id);
+
+        let verification;
+        try {
+          verification = await verifyRegistrationResponse({
+            response: response,
+            expectedChallenge: optionsCached.challenge,
+            expectedRPID: optionsCached.rp.id!,
+            expectedOrigin: config.mfa.passkeys.origin!,
+          });
+        } catch (e) {
+          console.error(e);
+          logger.warn('error verifying passkey registration');
+          return res.badRequest('Error verifying passkey registration');
+        }
+
+        if (!verification.verified) return res.badRequest('Could not verify passkey registration');
 
         const user = await prisma.user.update({
           where: { id: req.user.id },
           data: {
             passkeys: {
               create: {
-                name,
-                reg: reg as unknown as Prisma.InputJsonValue,
+                name: normalizedName,
+                reg: {
+                  webauthn: {
+                    webAuthnUserID: optionsCached.user.id,
+                    id: verification.registrationInfo.credential.id,
+                    publicKey: verification.registrationInfo.credential.publicKey,
+                    counter: verification.registrationInfo.credential.counter,
+                    transports: verification.registrationInfo.credential.transports,
+                    deviceType: verification.registrationInfo.credentialDeviceType,
+                    backedUp: verification.registrationInfo.credentialBackedUp,
+                  },
+                } as unknown as Prisma.InputJsonValue,
                 lastUsed: new Date(),
               },
             },
@@ -62,7 +171,6 @@ export default fastifyPlugin(
         logger.info('user created a new passkey', {
           user: user.username,
           name,
-          reg: reg.id,
         });
 
         return res.send(user);
diff --git a/src/server/session.ts b/src/server/session.ts
index ff5b6163..5ff1022f 100644
--- a/src/server/session.ts
+++ b/src/server/session.ts
@@ -5,14 +5,14 @@ import { FastifyReply, FastifyRequest } from 'fastify';
 import { IncomingMessage, ServerResponse } from 'http';
 import { getIronSession, type SessionOptions } from 'iron-session';
 
-const cookieOptions: SessionOptions['cookieOptions'] = {
+const cookieOptions: NonNullable<SessionOptions['cookieOptions']> = {
   // 2 weeks
   maxAge: 60 * 60 * 24 * 14,
   expires: new Date(Date.now() + 60 * 60 * 24 * 14 * 1000),
   path: '/',
   sameSite: 'lax',
-  httpOnly: false,
-  secure: false,
+  httpOnly: true,
+  // secure is set in below session functions based on config
 };
 
 export type ZiplineSession = {
@@ -24,6 +24,8 @@ export async function getSession(
   req: FastifyRequest | IncomingMessage,
   reply: FastifyReply | ServerResponse<IncomingMessage>,
 ) {
+  cookieOptions.secure = config.core.returnHttpsUrls;
+
   if (!(req as any).raw || !(req as any).raw) {
     const session = await getIronSession<ZiplineSession>(
       req as IncomingMessage,
@@ -56,6 +58,8 @@ export async function saveSession(
   user: { id: string } & Record<string, any>,
   overwriteSessions = true,
 ) {
+  cookieOptions.secure = config.core.returnHttpsUrls;
+
   session.id = user.id;
 
   if (overwriteSessions || !session.sessionId) {