Authentication
The process of verifying the identity of a user, device, or system—confirming that an entity is who it claims to be.
Detailed Explanation
Authentication answers the question "Who are you?" It is distinct from authorization, which answers "What can you do?" Common authentication methods include passwords, biometrics (fingerprint, face recognition), magic links, multi-factor authentication (MFA), and social login (OAuth).
Modern authentication has evolved beyond simple username/password. Passwordless authentication (magic links, passkeys), biometric authentication, and multi-factor authentication provide stronger security. The FIDO2/WebAuthn standard enables passwordless authentication using hardware security keys or device biometrics, eliminating passwords entirely.
Why It Matters
Authentication is the first line of defense for any application. Poor authentication leads to unauthorized access, data breaches, and loss of user trust.
Real-World Example
When you log into your bank, you enter your password (something you know), receive a code on your phone (something you have), and may use fingerprint recognition (something you are)—three factors of authentication.
When to Use
Every application with user accounts needs authentication. The method should match your security requirements and user experience goals.
Advantages
- Prevents unauthorized access
- Multiple methods available for different security levels
- Industry standards and libraries available
- Supports audit trails and compliance
- Enables personalized user experiences
Disadvantages
- Password management is a burden for users
- MFA adds friction to login flow
- Implementing auth correctly is complex
- Security depends on proper implementation
- Account recovery must be carefully designed
Related Terms
Frequently Asked Questions
What is the difference between authentication and authorization?
Authentication verifies identity (who you are). Authorization determines permissions (what you can do). Authentication always comes first—you must identify a user before determining their access level.
What is multi-factor authentication (MFA)?
MFA requires two or more verification factors: something you know (password), something you have (phone/token), and something you are (biometrics). MFA significantly reduces the risk of account compromise.
Should I implement passwordless authentication?
Passwordless auth (magic links, passkeys) improves UX and security by eliminating password-related vulnerabilities. However, it requires email delivery infrastructure and may not suit all user populations. Consider your audience.
How do I securely store passwords?
Never store plaintext passwords. Use bcrypt, scrypt, or Argon2 with a work factor of at least 12. Never use MD5 or SHA-256 alone for password hashing—they are too fast and vulnerable to rainbow table attacks.
What are passkeys?
Passkeys are FIDO2/WebAuthn credentials that replace passwords. They use public-key cryptography and are stored on the user's device (phone, laptop). They are phish-proof, don't require passwords, and are the future of authentication.