What is authentication? Passwords, biometrics, SSO, and modern methods explained

Authentication is the process of confirming that a user, device, or system is who they claim to be. It is distinct from authorization, which determines what an authenticated entity is allowed to do. Every time you log into an app, unlock your phone with a fingerprint, or sign a document digitally, you are going through an authentication step.

The most common authentication method for decades has been a username combined with a password — something you know. But passwords have well-documented weaknesses: they are easy to guess, reused across services, and phished at scale. Modern authentication systems layer multiple factors and use cryptographic protocols to reduce these risks.

How passwords work and why they fail

A password is a shared secret: both you and the system know it, and nobody else should. When you create an account, the system does not usually store your password in plain text. Instead, it runs the password through a cryptographic hash function and stores only the hash — a fixed-length string that cannot be reversed to reveal the original password.

When you log in, the system hashes what you typed and compares it to the stored hash. If they match, you are in. This means even if the database is leaked, the attacker only sees hashes, not passwords — provided the system uses a secure, slow hash function (such as bcrypt, Argon2, or scrypt) with a per-user random salt.

Despite this protection, passwords fail in practice for several reasons:

• Reuse — people use the same password on multiple sites. When one site is breached, attackers try the same credentials on other services (credential stuffing).
• Predictability — common passwords like 123456 or password are guessed in seconds by dictionaries.
• Phishing — fake login pages steal credentials directly from real users.
• No cryptographic protection — a password alone proves nothing about the device or session context.

Multi-factor authentication (MFA)

Multi-factor authentication adds one or more additional verification steps, so that compromising a single factor is not enough for access. The three classic factor categories are:

True MFA requires factors from at least two different categories. Using two passwords (something you know twice) is two-step but not two-factor.

Time-based one-time passwords (TOTP)

TOTP is the most common second factor. Both your device and the server share a secret key, and both run it through a shared algorithm that produces a 6–8 digit code that changes every 30 seconds. You see the code in an authenticator app (Google Authenticator, Authy, Bitwarden Authenticator) or a hardware token.

The code is valid for a short window (usually 30 seconds, with a 1-step tolerance before and after), so even if an attacker sees one code, it expires before they can use it.

SMS-based 2FA: a restricted method

SMS-based codes are sent by text message. Whether this channel is secure enough depends on your threat model: the US National Institute of Standards and Technology classifies SMS/voice codes sent over the public switched telephone network (PSTN) as a restricted authenticator under NIST SP 800-63B — permitted only with a documented risk assessment, user notification, and a migration plan, because of known weaknesses:

• SIM swap attacks let an attacker convince or bribe a carrier to move a victim's phone number to a SIM the attacker controls, redirecting the text messages to them.
• SS7 signaling attacks can let an operator near the victim intercept SMS traffic.
• VoIP and reassignable numbers may be registered by an attacker.

NIST guidance is clear that implementers of new systems should carefully consider alternatives. FIDO2/WebAuthn (hardware security keys) and TOTP authenticator apps are the recommended replacements for SMS-based OTP.

Hardware security keys (FIDO2/WebAuthn)

The strongest second factor for most users is a hardware security key — a physical USB or NFC device that implements the FIDO2 standard. WebAuthn is the web API that lets websites use FIDO2 without installing plugins.

When you authenticate with a security key, the device generates a cryptographic challenge-response pair using a private key stored in tamper-resistant hardware. The server stores only the public key. There is no shared secret to phish, intercept, or replay.

WebAuthn supports both second-factor (password + key) and passwordless (key only) flows. Major services including Google, GitHub, and Cloudflare support it.

Single sign-on (SSO)

Single sign-on lets users authenticate once and gain access to multiple applications without logging in again to each one. Instead of each app managing its own username and password database, a central identity provider (IdP) vouches for the user.

The most widely deployed SSO protocol is SAML 2.0 (Security Assertion Markup Language), an XML-based standard used by enterprise IdPs such as Okta, Azure AD, and Active Directory Federation Services. SAML exchanges signed XML assertions between the IdP and the service provider.

OAuth 2.0 (often paired with OpenID Connect) is the dominant standard for modern web and mobile applications. OAuth 2.0 is an authorization framework — it lets a user grant one application permission to access resources on another without sharing credentials. OpenID Connect (OIDC) adds an authentication layer on top, providing an ID token that the relying party can use to identify the user.

The flow with OpenID Connect works like this:

1. Your app redirects the user to the identity provider.
2. The user logs in at the IdP.
3. The IdP redirects back with an authorization code.
4. Your app exchanges the code for an ID token (user identity) and an access token (API access).
5. Your app validates the ID token and creates a session.

OAuth 2.0 and OIDC eliminate password sharing between services, centralize authentication security, and let users manage their identity in one place.

Biometric authentication

Biometric authentication verifies identity using physical or behavioral characteristics: fingerprints, facial geometry, iris patterns, voice, or typing rhythm. These are inherently tied to the person — you cannot forget them or lose them the way you can a password or a phone.

Biometric systems work in two phases. Enrollment captures and stores a digital representation (a template) of the biometric trait. Verification captures a new sample and compares it to the stored template using a matching algorithm. Modern systems use machine learning models to handle variation (different angles, lighting, age-related changes) while rejecting spoofed inputs (photos, silicone fingerprints, deepfake videos).

Biometrics are stored as templates, not images. Even if a database is breached, the original biometric trait cannot be reconstructed from the template — though it may be possible to generate a functional replica given enough known samples, which is why biometric systems should be paired with a liveness detection mechanism.

The main limitation of biometrics as a standalone factor is that they cannot be revoked. If a fingerprint is compromised, you cannot issue a new one. This is why biometrics work best as a convenience layer paired with a PIN or password (something you know) in a multi-factor setup.

Password managers

A password manager stores credentials in an encrypted vault. The master password — the only one you need to remember — unlocks the vault. All other passwords are generated randomly, stored securely, and auto-filled by the manager.

The security of a password manager depends on the strength of the master password and the security of the vault encryption. Reputable managers (Bitwarden, 1Password, KeePass) use zero-knowledge architecture: the vault is encrypted client-side before being sent to the server. The server never sees your master password or unencrypted data.

Password managers solve the reuse and predictability problems: every account gets a unique, long, random password. Combined with a strong master password and MFA on the manager itself, they are one of the most practical improvements to personal authentication hygiene.

Passwordless authentication

The long-term direction of authentication is passwordless: replacing passwords entirely with cryptographic credentials tied to a device or biometric. FIDO2/WebAuthn enables true passwordless login, where the private key is generated on your device and the public key is registered with the service.

Microsoft, Apple, and Google have all moved toward passwordless authentication. Passkeys — a FIDO2 credential managed by the operating system or a password manager — can replace passwords on supported sites, removing the entire class of phishing and credential-theft attacks.

FAQ

What is the difference between authentication and authorization?

Authentication confirms who you are — it verifies that a user, device, or system is who it claims to be. Authorization determines what an authenticated entity is allowed to do. Authentication always comes first: you prove your identity before the system decides which resources you may access.

What is the strongest form of multi-factor authentication?

The strongest widely available second factor is a FIDO2 hardware security key, which uses WebAuthn. It stores a private key in tamper-resistant hardware, the server keeps only the public key, and there is no shared secret to phish, intercept, or replay. Time-based one-time passwords (TOTP) in an authenticator app are a strong and more convenient alternative.

Why is SMS 2FA considered weak?

The US National Institute of Standards and Technology classifies SMS/voice codes sent over the public switched telephone network (PSTN) as a restricted authenticator under NIST SP 800-63B. SMS is vulnerable to SIM swap attacks, where an attacker convinces a carrier to move the victim's number to a SIM they control, and to SS7 signaling attacks that can intercept SMS traffic. FIDO2/WebAuthn and TOTP apps are recommended instead.

Can biometric authentication be hacked?

Biometrics are stored as templates, not images, and cannot be reconstructed from a stolen template. However, a functional replica can sometimes be generated from enough known samples, and — unlike a password — a biometric cannot be revoked if compromised. That is why biometrics work best as a convenience layer combined with a PIN or password in a multi-factor setup, ideally with liveness detection.

Related guides

• JWT authentication in Node.js — implement token-based authentication
• What is OAuth? — the authorization framework behind SSO
• What is CSRF? — protect authenticated sessions from cross-site attacks
• Web Crypto API — the browser APIs behind modern cryptographic operations