Authentication Methods
Overview
Authentication verifies identity before granting access — using one or more of five factor categories, implemented through methods ranging from passwords to hardware security keys.
Key concepts
- Five factor categories: know, have, are, somewhere, do
- Passwords, PINs, biometrics, certificates, tokens, hardware keys
- Password hygiene and password managers
How it works
Authentication verifies the identity of a user, device, service, or application before access is granted — using one factor or multiple.
Authentication factor categories
| Factor | What it covers |
|---|---|
| Something you know | Information the user memorizes — a password or PIN. |
| Something you have | A physical item or device in the user's possession. |
| Something you are | Biometric characteristics — fingerprints, facial recognition, iris scans, voice recognition. |
| Somewhere you are | Location — e.g. logging in from an approved office network, country, or region. |
| Something you do | Behavioral characteristics — typing patterns, mouse movement, touchscreen behavior, walking patterns. |
Common authentication methods
| Method | How it works |
|---|---|
| Password | A secret password or passphrase — should be long, unique, hard to guess, and stored in a password manager when possible. |
| PIN | A short numeric/alphanumeric code — commonly used to unlock devices, ATMs, phones, and secure apps. |
| Biometric | Verifies via physical or behavioral characteristics — phone unlocking, laptop login, building access, identity verification. |
| Certificate-based | Uses digital certificates to verify users, devices, or services — secure websites, VPNs, Wi-Fi access, encrypted email. |
| Token-based | A temporary token issued after successful sign-in — websites, cloud apps, APIs, SSO systems. |
| Hardware security key | A physical device used at login — helps prevent phishing since it verifies the legitimate website/service before responding. |
Password security
- Use a unique password for every account — reusing passwords means one stolen password compromises multiple accounts.
- Long passphrases are generally stronger and easier to remember than short, complex passwords.
- Use a password manager to generate and securely store strong passwords.
- Change default passwords immediately on routers, cameras, IoT devices, applications, and administrator accounts.