Credentials
Information (password, certificate, biometric) used to verify a user's identity during authentication.
What is Credentials?
Credentials are pieces of information used to verify a user's identity during authentication. Credentials fall into three categories (NIST): Something you know (password, PIN, security questions), Something you have (hardware token, smartphone, smart card), and Something you are (biometric - fingerprint, face, iris). Modern authentication uses multiple credentials (MFA): password + OTP, or biometric + hardware key. Credential security is critical - Verizon DBIR reports 81% of breaches involve stolen credentials.
Analogy
Think of credentials like the keys to your house. Different locks need different keys: your front door key (password), your car key (biometric), your mailbox key (hardware token). Each credential proves you have the right to access that specific resource.
Types and Use Cases
Credential Types (NIST Categories):
- Something You Know: Password, PIN, security questions, pattern lock
- Something You Have: Hardware token (YubiKey), smartphone (SMS/TOTP), smart card
- Something You Are: Biometric (fingerprint, FaceID, iris scan, voice)
- Where You Are: Geolocation, IP address (sometimes considered 4th factor)
Common Use Cases:
- Password + OTP: Most common MFA combination for consumer apps
- Hardware Key (FIDO2): Phishing-resistant credential for enterprises
- Biometric + PIN: Mobile apps with FaceID/TouchID + device PIN
- Certificate-Based: Enterprise apps with client certificates (mutual TLS)"
How it Works
{
"authenticationRequest": {
"userId": "user_12345",
"credentials": [
{
"type": "password",
"value": "hashed_and_salted",
"category": "something_you_know"
},
{
"type": "totp",
"value": "123456",
"category": "something_you_have",
"issuer": "google_authenticator"
}
],
"result": "success",
"sessionToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}
}Credentials vs Identity
Credentials
Identity
Credentials are used to prove your identity (password, biometric),
Identity is who you are (your digital representation)
Credentials can be changed/reset (new password), but your identity remains (same user ID)
You can have multiple credentials for the same identity (password, YubiKey, FaceID)
Best Practices for Credentials
- Use MFA: Never rely on single credential (password) - require at least two factors"
- Prefer Phishing-Resistant: Use FIDO2/WebAuthn over SMS OTP (phishing-vulnerable)"
- Credential Rotation: Force password changes periodically (90 days) and after suspected breaches"
How LoginRadius Powers Credentials
LoginRadius CIAM platform provides comprehensive credential management with secure storage (salted password hashes, encrypted MFA secrets), support for 15+ credential types (password, TOTP, FIDO2, SMS), breached password detection, and credential policies (complexity, rotation, history). Our platform uses industry-standard encryption (AES-256) and hashing (bcrypt/Argon2) with regular security audits and compliance certifications (SOC 2, ISO 27001).
FAQs
Identity is who you are (your digital representation - email, user ID, profile). Credentials are how you prove your identity (password, YubiKey, fingerprint). You have one identity but can have multiple credentials: password + TOTP + YubiKey all prove the same identity. If you change password, your identity remains the same.
Store credentials securely: (1) Passwords - hash with bcrypt/Argon2, use salt, never plaintext, (2) MFA secrets (TOTP seeds) - encrypt at rest, (3) Certificates - store in secure keystore (HSM, TPM). LoginRadius handles all credential storage securely with industry-standard encryption and hashing algorithms.
LoginRadius securely manages all credential types: (1) Passwords - stored as salted hashes (bcrypt), (2) TOTP/Hardware - encrypted at rest, (3) FIDO2/WebAuthn - private keys never leave user's device, (4) Breached Password Detection - real-time checking against known breached passwords. Our platform also provides credential policies (complexity, rotation, history) and breach detection APIs.