Authentication factors are the categories of evidence used to prove a user’s identity, traditionally grouped into three types: something you know, something you have, and something you are. Combining factors from different categories is what makes authentication strong, and it is the basis of multi-factor authentication.

The category matters more than the specific method. Two passwords are both "something you know," so requiring both adds little; a password plus a passkey draws on two different categories, which is genuinely harder to defeat.

The three factors

• Something you know: a password, PIN, or security answer. The weakest category, because knowledge can be phished, guessed, or leaked in a breach.
• Something you have: a phone, hardware security key, registered device, or passkey. Possession is much harder to steal at scale.
• Something you are: a biometric such as a fingerprint or face. Inherent to the person and convenient, though it must be handled carefully for privacy.

Some frameworks add "somewhere you are" (location) and "something you do" (behavior) as supporting signals.

Why factors matter

Multi-factor authentication works precisely because it requires evidence from more than one category, so compromising a single factor is not enough. The strongest modern authentication moves away from the knowledge factor entirely (passwordless), leaning on possession and inherence, which are far harder to phish. Understanding the factors is the foundation for reasoning about any authentication method’s real strength.

Frequently asked questions

What are the three authentication factors?

Something you know (password), something you have (device or passkey), and something you are (biometric).

Why combine factors from different categories?

Compromising one category (like a stolen password) isn’t enough if another independent factor is still required.

Which factor is weakest?

The knowledge factor (passwords, PINs), because it can be phished, guessed, or leaked.

Related: Multi-Factor Authentication (MFA) · Two-Factor Authentication (2FA) · Passwordless Authentication · Biometric Authentication · Passkeys