A roaming authenticator conforms to the FIDO Client to Authenticator Protocol. A cryptographic authenticator is one that uses a cryptographic key. In some cases, the authentication server software may be running on the authenticator hardware. On March 16, 2016, LastPass released LastPass Authenticator, a free two-factor authentication app. The attestation statement also contains metadata describing the authenticator itself. A secret or biometric stored on the authenticator is not shared with the website. Subsequently, the entity asserts an identity together with an authenticator as a means for validation. Some applications can be used to keep time-synchronized OTP, like Google Authenticator and password manager. The WebAuthn Client communicates with the authenticator using a JavaScript API implemented in the browser. Programmable tokens are marketed as "drop-in" replacement of mobile applications such as Google Authenticator (miniOTP). In multi-factor mode, the authenticator ("something you have") performs user verification. An ATM card is an example of a multi-factor authenticator. Given this openness, the identification number is never used as an authenticator. WebAuthn does not strictly require a roaming hardware authenticator.