Subjects and lessons to explore.

Law

Cybersecurity · Foundations

Authentication

9 min read 5 practice questions
10 key termsSourcesReport an error
Want it in plain words first? Jump to Eli explains — the same idea, no jargon.
On this page 9 sections
  1. In 30 seconds
  2. Why this matters
  3. The college version
  4. Eli explains
  5. Worked example
  6. Key takeaway
  7. Quick check
  8. Study tools
  9. Sources & references

In 30 seconds

is the process of verifying that someone is who they claim to be before letting them in. It answers one question: are you really the account holder you say you are? Proof comes in three broad kinds: , like a password; , like a phone or a security key; and , like a fingerprint or a face. Using two or more kinds at once is stronger than using one. Authentication only proves identity; deciding what an identity may do is a separate step called .

Why this matters

Every account, device, and service you use decides who you are through authentication. It is the gate in front of everything else: once someone passes it, they act with your name, reading your mail, spending your money, changing your data. Understanding how that gate works lets you see why a password alone is weaker than several proofs together, why a fingerprint is not a secret the way a password is, and why proving who you are and being allowed to do something are two different decisions. That distinction runs through every security discussion, from logging into a bank to how organizations protect their systems.

The college version

What authentication is

Authentication is the process of verifying that someone is who they claim to be before a system lets them act. NIST, whose Special Publication 800-63 series defines digital-identity practice, describes digital authentication as determining the validity of one or more authenticators used to claim a digital identity: establishing that the person attempting to access a service controls the credentials used to authenticate. Microsoft's identity documentation is plainer: authentication verifies a user's identity before granting access to apps, services, devices, or networks. The word "verify" matters. The person on the other side of a login screen can claim anything; authentication is the system's way of checking. It does not decide what the person may do, and it does not establish identity in any absolute sense. It determines, to some level of confidence, that the person presenting the credentials is the same person those credentials belong to.

The three factors

Authentication rests on three broad categories of proof, and almost every method in use is one of them. Something you know: a secret held in memory, such as a password or a PIN. NIST's authenticator guidance calls a password exactly this: something you know. Something you have: a physical object or device in your possession, such as a phone that receives one-time codes or a hardware security key. NIST describes these as physical authenticators, something you have. Something you are: a characteristic of your body, such as a fingerprint or a face. A biometric match is what NIST calls something you are. The categories matter because they fail in different ways. A secret can be guessed or stolen in a data breach; a device can be lost or borrowed; a biometric can be photographed, lifted from a surface, or spoofed. When a system asks for proof from only one category, an attacker who compromises that one kind of proof gets in.

Single-factor versus multi-factor

A is one of the three categories above, and the number of distinct categories a system requires sets the strength of the login. asks for one kind of proof, typically a password. asks for two or more different categories, such as a password plus a from your phone, or a security key plus a fingerprint. NIST's assurance levels make the logic explicit: at its higher levels, authentication requires proof of possession and control of two distinct authentication factors. Two proofs from the same category do not count as multi-factor; a password and a PIN are both something you know, so together they are still one factor. The reason multi-factor is stronger is simple: an attacker must compromise several different kinds of proof at once, and the categories are usually compromised through different means. The full details belong to a separate lesson; here the principle is the point.

Authentication versus authorization

Authentication and authorization are routinely confused, and the difference is critical. Authentication answers the question "who are you?" Authorization answers the question "what are you allowed to do?" — the decision about which resources an authenticated identity may access and what it may do with them. OWASP's guidance treats the two as separate controls: authentication verifies identity, authorization enforces permissions. A real login performs both, which is why they blur together. You type a password, authentication, and the system then decides whether your account may open the file you asked for, authorization. The two can diverge: a person can authenticate successfully and still be denied, because the identity is proven but the permission is missing. Authorization has its own lesson; here the takeaway is that proving who you are never, by itself, grants access to anything.

Common methods, and why authentication matters

The methods you meet every day are instances of the factors above. Passwords are the classic something you know. One-time codes, short numbers sent to a phone or generated by an authenticator app, are something-you-have proofs tied to a device you control. Biometrics, fingerprint, face, iris, are something-you-are proofs. Security keys are small hardware devices that connect to a computer and prove possession cryptographically; FIDO2 security keys and passkeys are the modern form of this idea. What unites them is the job they do: each gives the system evidence that the person at the keyboard is the account's owner. That job matters because identity is the gate to everything else. Accounts, devices, and networks decide what you may do by first deciding who you are, so the quality of the authentication determines whether an attacker can simply walk in as you.

The honest limits

No authentication method is perfect, and the limits are worth stating plainly. Passwords get stolen or guessed; phones get lost; one-time codes can be intercepted; even security keys have failure modes. Biometrics deserve special honesty. NIST points out that biometric characteristics are not secrets: your face is visible to cameras, fingerprints are left on objects you touch, and high-resolution photos can capture iris patterns. NIST also notes that biometric comparison is probabilistic, unlike the exact match of a password or key; biometrics must therefore be used only together with a physical authenticator, never as the sole proof. And unlike a password, which you can change the moment you suspect it leaked, a compromised biometric cannot simply be reset: you do not get a new fingerprint. The practical consequence is not despair but layering: treat each method as one piece of proof and rely on combinations rather than any single perfect method.

Eli, the EliExplains learning guide

Eli explains

The same idea, in plain words

Explain it like I’m 10

Authentication is how a computer checks that you are really you. When you say "I am Priya," the computer does not take your word for it; it asks for proof. The proof comes in three kinds. Something you know: a password in your head. Something you have: a phone in your pocket. Something you are: your fingerprint or your face. Each kind is one factor. One factor alone can be stolen or faked, so stronger logins ask for two different kinds at once. And proving who you are is not the same as being allowed to do things: the computer checks your identity first, then checks your permissions separately.

Picture it like this

Think of the door to a club. Saying "I am on the list" is a claim; the bouncer checking your ID is authentication. The ID itself is something you have, and comparing the photo to your face is something you are. If the club also asks for a password you memorized, that is something you know. But even after the bouncer confirms you are really you, a separate rule decides what you may do inside. That is authorization, a different decision made at a different door.

Where the picture stops working

The comparison has limits. A club bouncer sees your face and judges it in context, while computer authentication compares digital samples and can be fooled by fakes, photos, or stolen credentials. And a person can get a new ID when one is lost, but a compromised fingerprint cannot be replaced: some proofs are easier to renew than others.

Worked example

Amina works at a small clinic and signs in to the patient-records system. She types her password, something she knows. The system then sends a one-time code to the phone registered to her account, and she enters it, something she has, proving she controls that device. Only after both checks succeed is she authenticated: the system accepts that she is the account's owner. When she opens a patient file, the system separately checks whether her account is allowed to view that record; that check is authorization, and it can deny her even after a successful login. Two factors, two distinct decisions.

Key takeaway

Authentication verifies that someone is who they claim to be, using one or more of three factors: something you know, something you have, or something you are. More distinct factors mean stronger proof, authentication is not the same as authorization, and no method, biometrics included, is perfect.

Quick check

3 questions here, of 5 in this lesson’s practice set. Answers stay hidden until you check.

Question 1 of 3foundational

Which statement best defines authentication?

Choose an answer, then check it.
Question 2 of 3intermediate

A login asks for a six-digit code generated on a phone app. Which factor category is being used?

Choose an answer, then check it.
Question 3 of 3intermediate

Ravi signs in with his password and then approves a prompt on his phone. Which statement about the factors is correct?

Choose an answer, then check it.
Practice all 5

Keep learning

Ready to build on this? Continue to the next lesson.

Practice this lesson
Study tools & related lessonsYou’ll learn to · Common mistakes · Easily confused · Key vocabulary · Related

You’ll learn to

  • Define authentication as the process of verifying that someone is who they claim to be.
  • Name the three authentication factors — something you know, something you have, something you are — with an example of each.
  • Distinguish single-factor from multi-factor authentication and explain why distinct factors mean stronger assurance.
  • Distinguish authentication from authorization, using a scenario in which identity is proven but access is still denied.
  • Explain why no authentication method is perfect, including why biometrics cannot simply be reset like passwords.
  • Apply the concept of authentication to everyday sign-in scenarios.

Common mistakes

  • Thinking a password plus a PIN is multi-factor authentication.

    Both are something you know. Multi-factor requires two or more distinct categories of proof, such as a password plus a code from your phone.

  • Using the words authentication and authorization as if they mean the same thing.

    Authentication verifies who you are; authorization decides what you may do. A login performs both, but they are separate decisions.

  • Believing biometrics are unbreakable secrets.

    Biometric characteristics are not secrets: faces and fingerprints can be captured without your knowledge. NIST requires biometrics to be used together with another factor, not alone.

  • Assuming any extra step makes a login multi-factor.

    What counts is the category of the proof, not the number of steps. Two secrets from the same category are still one factor.

Easily confused

Authentication vs. Authorization

Authentication verifies who you are; authorization decides what you may do. A successful login does both, but the two decisions can diverge: identity can be proven while permission is denied.

Something you know vs. Something you have

A secret held in memory versus an object in your possession. They fail in different ways: secrets get guessed or stolen, devices get lost or borrowed.

Single-factor authentication vs. Multi-factor authentication

One category of proof versus two or more distinct categories. Multi-factor is stronger because an attacker must defeat several different kinds of proof at once.

Key vocabulary

authentication
The process of verifying that someone is who they claim to be, by checking the credentials they present.
factor
One of the three categories of proof used in authentication: something you know, something you have, or something you are.
something you know
A factor based on a secret held in memory, such as a password or PIN.
something you have
A factor based on possession of a physical object or device, such as a phone or security key.
something you are
A factor based on a characteristic of your body, such as a fingerprint or face.
single-factor authentication
Authentication that requires proof from only one factor category.
multi-factor authentication
Authentication that requires proof from two or more distinct factor categories.
biometric
A measurable body characteristic, such as a fingerprint or face, used as proof of identity.
one-time code
A short, single-use number delivered to a device, used as something-you-have proof.
authorization
The separate decision of what an authenticated identity is allowed to do.

Sources & references

  1. NIST Special Publication 800-63B: Authentication and Authenticator Management — National Institute of Standards and Technology
  2. NIST Special Publication 800-63B (rev. 3): Authentication and Authenticator Management, Section 5.2.3 Use of Biometrics — National Institute of Standards and Technology
  3. Authentication Cheat Sheet — OWASP Cheat Sheet Series
  4. Authorization Cheat Sheet — OWASP Cheat Sheet Series
  5. Microsoft Entra authentication overview — Microsoft Learn (Microsoft Entra ID)

EliExplains lessons are original prose written from the open, credible references above. See Copyright & Licensing.

Researched 2026-08-21

Educational content only. It is not medical, legal or professional advice. Found an error? Tell us.