Authenticator

An authenticator is a mechanism that confirms a user's claimed identity by verifying credentials or other factors before granting access to a system or resource. In information security, authenticators are used as part of multi-factor authentication to reduce the risk of credential theft. They can be categorized by the type of factor they provide: knowledge-based (something the user knows), possession-based (something the user has), and inherence-based (something the user is). Most common today are possession-based authenticators, such as hardware security keys and mobile apps that generate or verify codes.

Common authenticators include mobile apps such as Google Authenticator and Microsoft Authenticator, and hardware keys such as YubiKey and other FIDO2 devices.

Two common forms are time-based one-time password (TOTP) authenticators, which generate short-lived codes based on a shared secret and the current time, and push-based authenticators, which prompt the user to approve a login on a trusted device. Hardware keys implement public-key cryptography and satisfy WebAuthn/U2F standards, enabling phishing-resistant logins. Some systems use biometric data on a device to unlock an authenticator.

Standards and interoperability: TOTP (RFC 6238) and HOTP (RFC 4226) for codes, and WebAuthn/FIDO2 for cryptographic credentials. Practical deployment often involves enabling two-factor authentication in the service, distributing backup options such as recovery codes, and offering account recovery procedures.

Security considerations include protecting the authenticator device, using phishing-resistant methods where possible, and avoiding SMS-based codes due to SIM-swapping risk. Loss or compromise of an authenticator requires appropriate recovery processes to maintain access control.