Authenticator meaning: what an authenticator is
SHORT ANSWER
What does authenticator mean?
An authenticator is something you use to prove your identity to a service: a secret you know, a device you hold, or a trait of your body. In everyday use it usually means an authenticator app that makes one-time codes, but the word also covers security keys and passkeys.
Key takeaways
- Authentication proves you are who you claim to be. An authenticator is the thing that does the proving.
- Factors are something you know, something you have and something you are. Two or more together are multi-factor authentication.
- In NIST's guidelines an authenticator is something you possess and control that is used to authenticate. In WebAuthn it is the cryptographic device or software that makes passkeys.
- Authentication (who are you) is different from authorization (what you may do).
The plain meaning
To authenticate is to prove you are who you say you are. An authenticator is whatever you use to do that proving. A password is an authenticator you know. A phone that makes codes is one you have. A fingerprint is one you are.
Three kinds of factor
| Factor | Meaning | Examples |
|---|---|---|
| Something you know | A secret in your head | Password, PIN |
| Something you have | A device or object you hold | Phone with an authenticator app, security key, passkey |
| Something you are | A body trait | Fingerprint, face |
Using two or more kinds together is multi-factor authentication (MFA). Two steps of the same kind, such as two passwords, is not multi-factor.
What people mean in practice
- Authenticator app: an app that makes one-time codes. See authenticator app: what it is and how to choose one.
- Hardware authenticator or security key: a small device that signs a challenge when you touch it.
- Platform authenticator: the one built into your phone or computer, unlocked with your fingerprint, face or screen lock.
- Passkey provider: software that stores passkeys, such as HostSpica Passkey. See passkeys from first principles.
Standards use the word precisely
- NIST SP 800-63B: an authenticator is something the claimant possesses and controls, such as a cryptographic key or a password, used to authenticate.
- WebAuthn (W3C): an authenticator is the cryptographic entity that a browser uses to make and use public-key credentials.
- TOTP (RFC 6238): the "token" or app that makes the time-based code.
Authentication, authorization and authenticator
| Word | Means |
|---|---|
| Authentication | Proving who you are |
| Authorization | Deciding what you may do once identified |
| Authenticator | The thing that does the proving |
Read more terms in the glossary entry for authenticator.
Frequently asked questions
What is an authenticator app?
An app that makes one-time codes for two-step verification. It is one kind of authenticator.
Is a password an authenticator?
In standards language, yes: it is a secret you know that is used to authenticate.
What is the difference between authentication and authenticator?
Authentication is the act of proving identity. The authenticator is the thing you use to do it.
Is a fingerprint an authenticator?
It is a factor you are. On a phone it usually unlocks the real authenticator, such as a passkey key, rather than being sent to the site.
References
Review status
Last technical self-review by the author on 4 October 2026. No independent reviewer yet. If you spot an error, write to [email protected] and we will correct it and note the change.
Rohan builds HostSpica's Android apps — Authenticator, Passkey and Identity — and writes up how they work, including the mistakes along the way.
ABOUT THE PRODUCTS
RELATED