Authentication

Authentication is the process of verifying that a user or system is who they claim to be. When someone signs in to a website with a username and password, the site is authenticating them: checking the presented credentials against what it has on record to confirm the person's identity. Authentication answers the question "who are you?" and it is the front door of nearly every secure application. Until a visitor's identity is established, the system cannot safely decide what they should be allowed to see or do.

Mechanically, authentication compares something the user provides against something the system trusts. The most familiar form is a password, which the system stores in a scrambled, hashed form so that even the company cannot read the original, and checks by hashing the submitted password and comparing the results. Beyond passwords, authentication can rely on a code sent to a phone, a fingerprint or face scan, a hardware key, or a token issued by another trusted service. Multi-factor authentication combines two or more of these, so that stealing a password alone is not enough to break in. Once a user is authenticated, the system typically issues a session identifier or a signed token that the browser sends with each subsequent request, so the person does not have to prove their identity again on every page.

The word comes from the Greek "authentikos," meaning genuine or original, through the English word "authentic." At its heart, authentication is about confirming that something is genuine, that the person at the keyboard really is the account holder they say they are rather than an impostor.

For a business, authentication matters because it is the foundation of trust and security online. It protects user accounts, personal data, payment information, and private content from unauthorized access. A weak or broken authentication system exposes customers to account takeovers and the business to breaches, legal liability, and lasting reputational damage. Strong authentication, on the other hand, reassures users that their information is safe, which supports the confidence needed for people to sign up, subscribe, and buy. For any website that holds user accounts, getting authentication right is not optional.

The nuances and common mistakes are numerous and consequential. Storing passwords in plain text, rather than as salted hashes, is a serious and unfortunately common error. Allowing weak passwords, failing to offer multi-factor options, and building custom authentication from scratch when well-tested standards exist all increase risk. It is also vital not to confuse authentication with authorization: authentication confirms identity, while authorization determines what that identity is permitted to do, and the two are separate steps. Authentication relates closely to authorization as its natural partner, to OAuth as a standard for delegating it to trusted providers, and to JWTs and session tokens as the mechanisms that carry proof of identity after login. Treated with the seriousness it deserves, authentication is the safeguard that everything else in a secure system depends upon.