Authentication is the process of establishing or verifying the identity of a subject before granting access to a system, service, device, application, network, or resource. The subject may be a human user, a service account, an application, a machine, a device, or another system component. In security terminology, authentication answers the question “Who or what are you?” rather than “What are you allowed to do?”
The authentication process normally involves an identifier, such as a username, account name, email address, device identity, or certificate identity, together with one or more authenticators that provide evidence that the claimed identity is genuine. Authentication is therefore distinct from identification: identification establishes which identity is being claimed, while authentication verifies that claim. The distinction is important because an identifier by itself normally provides little assurance that the person or system presenting it is actually the legitimate owner of that identity.
Authentication mechanisms are commonly categorised according to authentication factors. A knowledge factor is something the subject knows, such as a password, PIN, passphrase, or memorised secret. A possession factor is something the subject has, such as a hardware security key, smart card, cryptographic token, or registered mobile device. An inherence factor is something the subject is, normally represented by a biometric characteristic such as a fingerprint, facial characteristic, iris pattern, or voice characteristic.
Some systems also consider contextual or behavioural evidence, such as device location, network characteristics, typing behaviour, transaction patterns, or device posture. Multi-factor authentication, commonly abbreviated MFA, combines evidence from two or more independent factor categories, whereas merely requiring two different passwords is still generally a single-factor scheme because both secrets belong to the knowledge category. Strong authentication therefore depends not simply on the number of credentials but on the independence and security properties of the factors involved.
Password authentication remains widespread because it is inexpensive and straightforward to deploy, but passwords have well-known weaknesses including phishing, credential stuffing, password reuse, guessing, offline cracking after database compromise, and disclosure through malware or social engineering. Password storage should therefore use an appropriate password-derived key or password-hashing algorithm with a unique salt and deliberately expensive computation rather than reversible encryption or fast general-purpose hashes. Modern authentication increasingly uses cryptographic protocols that avoid sending reusable secrets to the server.
Passkeys based on WebAuthn and FIDO2, for example, use public-key cryptography so that the service stores a public key while the private key remains under the user's control, typically protected by a device authenticator. This approach can provide strong resistance to conventional phishing because authentication is cryptographically bound to the legitimate relying-party origin.
Authentication can also be performed through protocols designed for particular environments. Kerberos provides ticket-based authentication commonly used in enterprise environments, allowing a trusted authentication service to issue time-limited tickets that can subsequently be used to access services without repeatedly transmitting a password. OAuth 2.0 is primarily an authorisation framework rather than an authentication protocol, although it is frequently confused with authentication because it is used in login architectures; OpenID Connect adds an identity layer to OAuth 2.0 and provides standardised identity information.
SAML is another widely deployed federation technology, particularly for enterprise single sign-on. LDAP can provide directory-based identity services and may participate in authentication architectures, although LDAP itself is a directory access protocol rather than a complete universal authentication mechanism. These distinctions matter because the protocol carrying credentials, the protocol issuing assertions, and the system maintaining identities can be separate components.
Federated authentication allows one identity provider to authenticate a subject on behalf of another service. In a typical single sign-on arrangement, the user authenticates to an identity provider and receives a cryptographically protected assertion or token that a relying application can validate. Federation can reduce the number of passwords users must manage and centralise security controls such as MFA, account lifecycle management, and conditional access.
It also introduces dependencies: compromise or unavailability of a central identity provider can affect many relying services, while incorrectly configured trust relationships can permit unauthorised access across organisational boundaries. Assertions commonly include an audience, issuer, subject, validity period, and integrity protection, and relying parties must validate these properties rather than simply accepting any structurally valid token. Authentication systems consequently depend heavily on secure key management, accurate time synchronisation, certificate validation where applicable, secure session handling, and correct trust configuration.
Authentication assurance can vary substantially even when two systems both claim to support authentication. A password entered into a phishing site provides little useful assurance to the legitimate service because the attacker can simply relay or reuse it, whereas a hardware-backed cryptographic authenticator can provide stronger proof of possession of a private key.
Biometric authentication has different properties: biometrics are useful for unlocking an authenticator or establishing local user presence, but they are not normally treated as secret information because fingerprints and faces cannot be replaced in the same way as passwords. Biometric systems also involve false acceptance and false rejection rates and can be affected by presentation attacks, sensor quality, environmental conditions, and demographic performance differences. Authentication assurance should therefore be evaluated according to the threat model, credential protection, protocol design, recovery procedures, and consequences of compromise rather than by the name of the authentication method alone.
Authentication is also a lifecycle rather than merely a login event. Secure systems need processes for enrolment, identity proofing, credential issuance, credential binding, authentication, session establishment, credential rotation or replacement where appropriate, revocation, account recovery, and eventual deprovisioning. Account recovery is particularly important because an extremely strong primary authentication mechanism can be undermined by a weak recovery process that allows an attacker to bypass it.
Systems may also use step-up authentication, requiring stronger verification when a user performs a sensitive operation, changes security settings, accesses restricted information, or presents unusual contextual characteristics. Session management is related but distinct: successful authentication establishes an authenticated session, while session identifiers, tokens, cookies, expiration rules, reauthentication requirements, and logout mechanisms determine how that authenticated state is maintained.
Authentication is foundational to security architectures because subsequent decisions about authorisation and access control depend on having an appropriately established identity or security principal. Nevertheless, successful authentication does not itself establish that access should be granted to a particular resource or operation. A legitimate employee may authenticate successfully but have no permission to access payroll records, and a compromised administrator credential may authenticate correctly while being used maliciously.
Authentication can also be performed for machines and services through certificates, workload identities, signed tokens, managed identities, or other cryptographic credentials rather than interactive passwords. Common misconceptions include treating authentication and authorisation as synonyms, assuming MFA automatically prevents every form of account compromise, and assuming a successfully authenticated identity is inherently trustworthy. In practice, effective authentication is one component of a broader identity, access, session, monitoring, and security-control architecture.
