Authentication factors explained: what you know, have, and are

The login page already believes you. Your password was accepted, and then the service asks for one more thing — a six-digit code, a tap on a key, a look at the camera. What it asks for decides the strength of that login, and the word for it, factor, is the most misused term in security marketing.

A factor is not a step or a second prompt — it is a category of proof. Three matter, plus a queue of hopefuls trying to look like members. What follows is the map: the three real factors, the rule that makes two of them count, the quality range inside possession, and the ladder the US government uses to grade the results.

Something you know, something you have, something you are

Every factor you have ever presented falls into one of three categories, old enough to have grandchildren.

Something you know is information that lives in your head: a password, a PIN, a lockscreen pattern, your first pet's name as demanded by a security question. It is the internet's default factor, and its weakness is structural — anything you know can be phished out of you or guessed, and billions of known-things sit in breach databases waiting to be tried against your username.

Something you have is an object: the phone receiving a code, a YubiKey on a keychain, the chip card you dip at an ATM, a badge on a lanyard. Possession proofs are strong because an attacker must reach a specific thing rather than a reusable fact, and hardware tokens make extracting the secret genuinely difficult. The weakness is obvious — objects are lost, stolen, dropped in lakes, and drained of battery.

Something you are is your body: fingerprint, face, iris, voice. Biometric 2FA feels like the strongest of the three — you cannot forget your face. Hold that thought — the same property is the core argument against it.

For the surrounding story — what a second proof buys you — the two-factor authentication overview covers it. The rest of this post is anatomy.

The extras that keep trying to join

Certification textbooks offer a fourth and fifth factor: somewhere you are (location) and something you do (behavior). Both deserve skepticism.

Location is a signal, not a credential. Your IP address reports where your traffic appears to come from, and it can be wrong, shared, or disguised. When a bank freezes a foreign card purchase, it is using location as a risk signal — a good one — but it measured you without asking, and a factor is something you present on purpose. NIST's Digital Identity Guidelines sort authenticators into knowledge, possession, and inherence, and leave location out of the taxonomy.

Behavior has the same problem plus worse ones. Typing rhythm, gait, signature pressure — all can be observed and imitated, all drift when you are tired or injured, and none can be reissued after they leak, which is why serious systems use them for background risk scoring, not login credentials. Outside marketing decks and exam flashcards, something you do barely exists.

The rule that matters: two different factors

A factor is a category, not a count. Two-factor authentication means proofs from two different categories — knowledge plus possession, knowledge plus inherence, or possession plus inherence. That distinction is the whole game. Password plus security question is one factor wearing two hats: both are things you know, and the second is often guessable from your public life anyway. Password plus a PIN: still one factor. Password plus a code from an authenticator app: genuinely two, because the code certifies that a specific device holding a specific secret is in your pocket.

The most common satisfaction is a memorized secret plus a one-time password — what TOTP is explains how that 30-second code is computed on your phone. The two-hats mistake is not hypothetical — services still offer your mother's maiden name as a second step, which adds the security of a second question mark.

The possession spectrum: SMS to FIDO2

Nearly everything interesting in modern 2FA happens inside possession, and the quality range there is enormous.

Method	Phishing resistant	Works offline	Typical cost	Main failure mode
SMS code	No	No	Free	SIM swap, dead zones, carrier filtering
TOTP app code	No	Yes	Free	Clock drift, lost phone, code relay
Push approval with number matching	Mostly	No	Free with your platform	Prompt fatigue, no signal
FIDO2 hardware key or passkey	Yes	Yes, for the credential itself	From about $25	Loss, and not every site accepts it

The SMS row is the one to replace first. The thing you have is your phone number, which your carrier rents to you and can be persuaded to transfer to a stranger — a SIM swap. NIST handles this by classification rather than ban — phone-network out-of-band verification is marked RESTRICTED, allowed only with explicit risk assessment.

The TOTP row is the workhorse. The app and the service share a secret and compute the same code from it and the clock, per RFC 6238 — nothing is sent to you, so generation works in airplane mode. Phishing survives: a fake login page can relay your code in real time. What TOTP removes is the carrier, the dead zone, and the swapped SIM.

Push approvals are the convenient middle. A prompt appears on a signed-in device, and current systems ask you to match a two-digit number against the login screen — number matching exists to blunt prompt fatigue, the attack that wore down an Uber contractor with repeated pushes in 2022 until one was approved, as NPR reported. Push needs a data connection, its recurring annoyance in basements.

The FIDO2 row is the destination. A hardware key or a device-bound passkey proves possession with a private key that only answers the genuine site's real domain, so a phishing page receives nothing to replay — that is what phishing resistant means, and the UK's National Cyber Security Centre compares the properties with traditional credentials. The hardware keys guide covers choosing one. The short version: buy two.

Where NIST puts your everyday methods

NIST Special Publication 800-63B grades login strength on three rungs.

AAL1 — some assurance that you control the authenticator. Any single factor qualifies, and a password alone lives here.

AAL2 — high confidence. Two distinct factors, or one authenticator that is itself multi-factor, with reauthentication at least every 12 hours in an extended session. Password plus TOTP is the textbook pairing — the publication's own category is a single-factor OTP device alongside a memorized secret. A passkey opened with the phone's fingerprint is a multi-factor authenticator in one device. SMS is the RESTRICTED case from the table above.

AAL3 — very high confidence. A hardware-based authenticator that resists verifier impersonation — even malware on the computer you are typing at cannot fabricate or steal the proof. A FIDO2 hardware key with its own PIN or touch satisfies this — the everyday method that reaches AAL3. A TOTP app on a general-purpose phone cannot, because other software on that phone could read the code. That is the exact line the publication draws between AAL2 and AAL3.

For currency: NIST finalized SP 800-63-4, the suite's 2025 revision, and the three rungs survive with sharper requirements — phishing-resistant options must be offered at AAL2. TOTP remains AAL2 territory and FIDO2 on hardware the everyday path to AAL3 under both editions.

Biometrics' odd position

Biometrics are the inherence factor, yet they behave like possession of your body: you carry the credential everywhere, it can be lifted without your cooperation — fingerprints come off drinking glasses — and it cannot be reissued after compromise. You get ten fingerprints and one face, forever.

NIST's rule is blunt: biometrics shall be used only as part of multi-factor authentication with a physical authenticator, never alone. Face sign-in on a phone shows the design working: the camera checks your face, the phone proves possession cryptographically to the service, and the server never sees your biology — the internet receives a device's attestation, not your face. A biometric on a device is a gate in front of a possession proof.

2FA, MFA, and step-up authentication

Marketing flattened these three terms into one, but they mean different things.

Two-factor authentication is credentials from two distinct categories. The abbreviation gets misused for any second step, including second knowledge factors — the costume from earlier.

Multi-factor authentication is the superset: two or more factors, same distinctness requirement, and in practice the same login almost all the time. MFA is simply the word that scales past two.

Step-up authentication is about timing, not count. You signed in at one strength, and a sensitive action demands more mid-session: the bank takes password and TOTP code at the door, then asks for an app approval before adding a new payee. The factors did not multiply — the stakes did.

Frequently asked questions

What are the three types of authentication factors?

Knowledge, possession, and inherence. Knowledge is information you hold in your head — password, PIN, security-question answer. Possession is an object you control — phone, hardware key, smart card. Inherence is your body — fingerprint, face, iris, voice. A login presenting credentials from two different categories is two-factor authentication — two from the same category is still one factor. NIST's guidelines use this exact taxonomy, and anything marketed as a fourth factor — location, behavior — is a risk signal borrowing the vocabulary.

Is a password plus a security question two-factor authentication?

No. Both are things you know, so the login presents one factor twice. A security question is a second password with worse properties — answers are often public record and guessable from your social media. Two-factor authentication requires credentials from different categories — a password plus a code from an app, or a password plus a hardware key. If a service offers security questions as the second step, treat the account as single-factor.

Is biometric login stronger than a password?

It is different more than it is stronger. A fingerprint cannot be phished out of you, but it cannot be rotated once it leaks, and it can be lifted from surfaces you touch. NIST's rule reflects the ambivalence: biometrics only as part of multi-factor authentication with a physical authenticator, never standalone. In the dominant design — face sign-in on a phone — the biometric gates the device, and the device presents a cryptographic possession proof to the service. Your face never travels. The math does.

Where does SMS two-factor authentication rank?

It is a real second factor delivered over the worst channel. The possession proof is your phone number, which your carrier can be socially engineered into transferring — a SIM swap. NIST marks phone-network out-of-band verification as RESTRICTED: permitted at AAL2 only with an explicit risk acceptance, because you cannot control the channel. Use SMS where nothing better is offered, but replace it with an authenticator app the moment the service supports one — especially for email and exchanges.

What is the strongest second factor I can actually use?

A FIDO2 hardware security key or a device-bound passkey. The credential answers only the genuine site's domain, so phishing pages get nothing to replay, and a key with its own PIN or touch meets the requirements NIST reserves for AAL3. Buy two, because the dominant failure mode is losing one. For services that only offer authenticator apps, TOTP is the honest baseline — offline, no carrier, tolerant of a minute of clock disagreement, phishable only by real-time relay.

If the possession side of your setup needs attention, start with the guest generator: paste a secret and watch a code appear — zero network requests, no account, nothing stored.