Authenticators

An authenticator is a factor or device used to verify a user's identity during an authentication event. In information security, authenticators are the means by which a system confirms that the person or entity attempting to access it possesses a credential that the system trusts. Authenticators are typically categorized by the type of factor they provide: something you know (passwords or PINs), something you have (hardware tokens, mobile devices or smart cards), and something you are (biometric identifiers such as fingerprints or facial recognition).

Hardware authenticators include security keys such as USB, NFC, or Bluetooth devices; smart cards; hardware tokens that generate time-based codes. Software authenticators include authenticator apps that generate one-time codes (TOTP or HOTP) and push-based authenticators that prompt the user to approve a login. Platform authenticators are built into devices, such as Windows Hello or Apple Face ID, and can often serve as a biometric or cryptographic authenticator.

Web and app protocols: Modern web standards such as WebAuthn and FIDO2 define authenticators that use public-key cryptography; a credential is created during registration and a challenge-response is performed during authentication. Other schemes include SMS-based or email codes; these are generally considered weaker due to interception or SIM swapping risks.

Security considerations: Authenticators improve security by reducing reliance on passwords alone, offering phishing resistance in many configurations. They require recovery options and careful management of backups. They are used across consumer and enterprise contexts, with widely adopted standards including FIDO2/WebAuthn, OAuth 2.0 and OpenID Connect through various integrations.