Authentication proves you are who you claim to be. A username and password is the classic method. It is also the weakest. Passwords get reused, phished, and cracked. Multifactor authentication adds a second factor: something you have, like a phone or hardware key, or something you are, like a fingerprint. With MFA, a stolen password alone is not enough.

The factors fall into three categories. Knowledge is something you know, like a password or PIN. Possession is something you have, like a phone or smart card. Inherence is something you are, like a face or fingerprint. Strong authentication combines at least two from different categories. A password plus a text message code is better than a password alone, but SMS codes can be intercepted through SIM swapping. Authenticator apps and hardware security keys resist that attack. Passkeys push further, replacing passwords entirely with cryptographic credentials tied to a device. Adoption is growing but uneven. Most breaches still start with a compromised credential. MFA blocks the vast majority of those attempts.

Authentication factors

• Knowledge — password, PIN, security question
• Possession — phone, hardware token, smart card
• Inherence — fingerprint, face, voice
• Location and behavior — risk-based signals

Authentication is not authorization. Proving who you are comes first. What you are allowed to do comes after.