# What is Authentication?

> Authentication is the process of establishing confidence that a claimant controls one or more authenticators bound to the identity or account being presented.

- Canonical URL: https://yellowcube.eu/glossary/authentication/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It can apply to a person, device, service, or process. A successful result establishes an authentication context for a session or transaction; it does not decide what the authenticated subject may access.

Digital authentication should be designed as a lifecycle, not just a sign-in screen. Enrollment and authenticator binding establish the relationship, routine verification tests control of the authenticator, and recovery, replacement, revocation, and session management preserve that assurance over time. The required strength should reflect the harm that impersonation could cause.

### Key points

- **Common evidence:** Passwords, cryptographic keys, security keys, one-time codes, smart cards, device-bound credentials, and biometrics used to activate an authenticator.
- **Protocol quality:** Resistance to guessing, replay, interception, verifier impersonation, phishing, and automated attack differs significantly between methods.
- **Operational controls:** Protect enrollment, recovery, authenticator changes, fallback methods, verifier secrets, and authenticated sessions as carefully as routine sign-in.
- **Important limitation:** Authentication does not prove that every stored attribute is correct, that the endpoint is safe, that the session remains under the subject’s control, or that any requested action is authorized.

### Related terms

[Multi-factor authentication (MFA)](<https://yellowcube.eu/glossary/multi-factor-authentication/>) · [Passwordless authentication](<https://yellowcube.eu/glossary/passwordless-authentication/>) · [Passkey](<https://yellowcube.eu/glossary/passkey/>) · [Federated identity](<https://yellowcube.eu/glossary/federated-identity/>) · [Authentication token](<https://yellowcube.eu/glossary/authentication-token/>) · [Phishing-resistant authentication](<https://yellowcube.eu/glossary/phishing-resistant-authentication/>) · [Session management](<https://yellowcube.eu/glossary/session-management/>) · [Account recovery](<https://yellowcube.eu/glossary/account-recovery/>)

### Sources

[NIST glossary: Authentication](https://csrc.nist.gov/glossary/term/authentication) · [NIST SP 800-63B-4: Authentication and Authenticator Management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.