Authentication

Checking that a returning user is the same person who signed up, every time they log in or attempt a sensitive action.

It is the step that happens after an account already exists. The person proves again, on every visit, that they are the one who owns it, for example by typing a password, approving a prompt on their phone, or unlocking the app with a fingerprint or face scan.

The process of confirming that someone returning to an existing account is the person who enrolled, by checking one or more authenticators they control. An authenticator is a proof that the service links to the account at signup: something the person knows (a password or personal identification number, PIN), has (a phone, security key, or passkey), or is (a fingerprint or face scan). Authentication runs at every login and can run again mid-session before a sensitive action, usually producing a pass or fail result against the strength of proof the service requires.

A typical login follows these steps:

The person presents a proof, such as a password, a fingerprint, or a passkey.
The service compares it with the proof it recorded when the person created the account.
Many services also weigh signals around the attempt, such as a new device or an unusual location, to judge risk.
A match on a low-risk attempt opens the session. A mismatch, or a risky attempt, blocks it or asks for another proof.

Each kind of proof is called a factor. The most common methods are:

Passwords are familiar, but people reuse them across sites, and a single breach can expose them.
One-time passcodes (OTPs) are short codes sent by text or email that expire quickly. Attackers can intercept them, for example through a SIM swap, where a criminal talks a phone carrier into moving the victim's number to a criminal-controlled SIM (subscriber identity module) card, the chip that links a phone to its number.
Passkeys replace the password with a pair of cryptographic keys. The private key stays on the person's device, so there is no password or code for an attacker to capture on a fake site.
Biometrics use a face, fingerprint, or voice, either on the device or through a verification service.
Multi-factor authentication (MFA) requires two or more different kinds of factor, such as a password plus a fingerprint, so one stolen secret is not enough to get in.

Authentication also sits next to two terms that are easy to mix up:

Identity verification proves who someone is, usually once at signup, by checking an ID document against a live selfie.
Authorization decides what a person can do once the service has authenticated them.

Why it matters

Identity verification, the check that proves who someone is, happens once at signup. Authentication happens every session after that, because without it, a stolen password would grant permanent access. Account takeover, where a criminal gets into an existing customer's account, happens when an attacker gets past this step.

A password alone is a single check that can be guessed, reused, or leaked, so services add a second kind of proof to make a stolen password far less useful to an attacker. A passkey, a login stored on the person's device that replaces the password, resists phishing because there is no password or code to capture, which makes it a strong option wherever it is supported. The right mix still depends on how risky the action is.

Services also reduce friction by matching the strength of the check to the risk. A routine login might need one check, while a large transfer or a change to account recovery settings triggers step-up authentication, an extra check in the middle of a session.

The stakes grow as AI agents start acting on people's behalf. An agent can hold a fully valid, authenticated session while its actual behavior drifts into fraud, so a successful login alone cannot confirm who is behind the actions.

FAQ

Frequently asked questions

Still have questions? Talk to an expert

What is the difference between authentication and identity verification?

Identity verification proves who someone is, usually once at signup, by checking an ID document against a live selfie. Authentication confirms that a returning person is still that same individual, each time they log in.

What is the difference between authentication and authorization?

Authentication confirms who is logging in. Authorization decides what that person can do afterward. Logging in to a banking app is authentication, while the rule that only the account owner can approve a transfer is authorization.

Is a password enough to authenticate someone?

Rarely, for anything valuable. A password is a single factor, and it can be guessed, reused, or leaked, so services usually pair it with a second kind of proof.

Is a text message code a safe way to authenticate?

It adds a second factor, which beats a password alone, but it has weaknesses. Attackers can intercept the code, for example by taking over the person's phone number, or trick the person into reading it out. Passkeys and security keys avoid both problems.

Can biometrics authenticate someone?

Yes. A face, fingerprint, or voice can serve as the "something you are" proof, checked either on the person's own device or by a verification service. Strong systems also run liveness detection, a check that a real person is present in front of the camera, because a face match alone can be fooled by a printed photo.

What is the strongest form of authentication?

No single method wins everywhere. Passkeys resist phishing because there is no password or code to capture, so they are a strong option wherever they are supported. The right mix depends on how risky the action is.