# What are Login Credentials?

> The phrase “login credentials” is a common umbrella term for the identifiers and authenticators used to sign in to an account or service.

- Canonical URL: https://yellowcube.eu/glossary/login-credentials/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

A typical login collects a username and password, but credentials may instead include a certificate, passkey, security key, one-time password, or another authenticator. Some components identify the account; others prove control of it.

The components need different handling. A username is often not secret; a password is a shared secret; and a passkey proves possession of a private key without sending that key to the service. Successful login normally creates an authenticated session with its own secret, which must remain protected even though it was not entered on the login screen.

### Key points

- **Authentication design:** Select authenticators according to the required assurance, phishing resistance, user population, device context, and recovery risk.
- **Storage and transport:** Protect authentication exchanges, store password verifiers rather than recoverable passwords, and keep private keys and other secrets out of logs and untrusted applications.
- **Lifecycle:** Secure enrollment, binding, reset, recovery, replacement, revocation, and compromise response; weak fallback can undermine the normal login method.
- **Important limitation:** “Credentials accepted” does not prove the legitimate owner is present. Stolen passwords, authenticators, recovery channels, or session secrets can let an attacker appear to be a valid user.

### Related terms

[Authentication](<https://yellowcube.eu/glossary/authentication/>) · [Multi-factor authentication (MFA)](<https://yellowcube.eu/glossary/multi-factor-authentication/>) · [Passwordless authentication](<https://yellowcube.eu/glossary/passwordless-authentication/>) · [Authentication token](<https://yellowcube.eu/glossary/authentication-token/>) · [Account takeover (ATO)](<https://yellowcube.eu/glossary/account-takeover/>) · [Password manager](<https://yellowcube.eu/glossary/password-manager/>) · [Cryptographic hashing](<https://yellowcube.eu/glossary/cryptographic-hashing/>) · [Password spraying](<https://yellowcube.eu/glossary/password-spraying/>)

### Sources

[NIST SP 800-63B-4: Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html) · [CISA and NSA: Identity and Access Management Recommended Best Practices](https://www.cisa.gov/sites/default/files/2023-12/ESF%20IDENTITY%20AND%20ACCESS%20MANAGEMENT%20RECOMMENDED%20BEST%20PRACTICES%20FOR%20ADMINISTRATORS%20PP-23-0248_508C.pdf)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.