Skip to main content
Mobius
Intermediate

What is authentication

Also known as: auth, login, sign-in, two-factor authentication, 2FA, MFA

Definition

Authentication is the check that a user is who they claim to be, using something they know, something they have or something they are.

Why it matters

A stolen or guessed password is the easiest way into a business's systems, so the login is where customer accounts, payouts and admin panels are protected or lost.

Common mistakes

Sharing one admin login among the whole team, so nobody knows who did what and a departing employee keeps access.

Related terms

Worked exampleIllustration

Two step verification on a shop's admin panel

The login screen, its parts marked

  • Email addressWho you claim to be
  • PasswordSomething you know
  • Code from the authenticator appSomething you have
  • Or: sign in with a passkeyYour device signs

After login: what each person may do

  • Owner: orders and payouts
  • Employee: orders
  • Employee: payouts

Steps

  1. The owner logs in with a password, something they know.

  2. Decision: The system asks for a six digit code from an authenticator app on the owner's phone, something they have.

  3. Only with both does the admin panel open. That is authentication.

  4. A part time employee logs in the same way but sees orders, not payouts. That is authorization.

  5. A password stolen in a phishing email no longer opens the store on its own.

Set up the same two steps today on the business Google account and the bank.

Illustration

Add a lock of another kind

Two kinds: two step verification

Two different kinds. A stolen password alone no longer opens the account, the thief also needs the phone.

NIST SP 800-63B: factors are something you know, have or are, and only different kinds add up.

A factor is something you know, have or are. Two different kinds make two step verification. Two of the same kind do not.

Who are you, and what may you do

Authentication

Who are you?

Checked at the door, like an ID.

The owner enters a password and the code from the app, and the admin panel opens.

Authorization

What may you do?

Checked after you are in, like a ticket to one room.

A part time employee logs in the same way and sees orders, not payouts.

Two checks that are easy to mix up. The first happens at the door, the second after you are in.

Definition

Authentication is the process of confirming the identity of a user, a device or a system before it gets in. The system checks the proof the user presents, and the proof comes from three kinds of factor: something you know (a password or a PIN), something you have (a phone or a security key) and something you are (a fingerprint or a face). Two-factor authentication (2FA), and multi-factor authentication (MFA) more broadly, combine factors of different kinds, so a stolen password alone is not enough. The check is not always a password compared with a stored record: a passkey proves identity with a cryptographic signature made on your device, and "Sign in with Google" hands the check to an identity provider, which is single sign-on. That saves you storing passwords, and it also means a takeover of the provider account becomes a way into yours. Authentication answers "who are you?". Authorization, the step after it, answers "what may you do?".

Why it matters

The current US standard, NIST SP 800-63B-4 (July 2025), reverses much of the folklore: it says composition rules such as a required mix of character types shall not be imposed, and periodic password changes shall not be required unless there is evidence of compromise. It asks for length instead, at least 15 characters when the password is the only factor and at least 8 inside multi-factor authentication, and for a check against a blocklist of common or compromised passwords. It classes codes sent by SMS or phone call as a restricted method, so an authenticator app or a passkey is stronger, although an SMS code still beats a password alone. The FIDO Alliance describes passkeys as "phishing resistant and secure by design". In Israel, the National Cyber Directorate's 2018 guide for small businesses lists two step verification among its ten basic recommendations. It is advice, not law.

Directly related: Server, Database, Client (computing).

Improvement tips

  • Turn on two step verification today for the business Google or Microsoft account, Meta Business, the domain registrar, the bank and the accounting software.
  • Prefer an authenticator app or a passkey to SMS codes, and keep SMS only where nothing better is offered.
  • Ask for long passwords and a check against leaked passwords, not rules about symbols and capital letters.
  • Use your platform's built in login or an established login service, instead of having a developer write one from scratch.
  • Give each employee their own account, and remove it the day they leave.

Common mistakes

  • Storing passwords in plain text or with weak hashing.
  • Forcing symbol rules and monthly password changes, which push people to predictable passwords written on notes.
  • Confusing authentication (who you are) with authorization (what you may do).
  • Allowing unlimited login attempts, which invites automated guessing.

Related terms

TechnologyBeginner

Server

A server is a computer, or a program on one, that receives requests from other programs, such as a visitor's browser, processes them and sends back an answer.

TechnologyBeginner

Database

A database is an organised collection of information, usually tables of rows and columns, that software can search, update and link, like customers to orders.

TechnologyBeginner

Client (computing)

A client, in computing, is the program, such as a browser or an app, that sends a request to a server and shows you the answer. It is not your paying customer.

TechnologyIntermediate

API

An API (application programming interface) is the agreed way one program asks another for data or an action and gets an answer, so your tools can work together.

TechnologyBeginner

Vibe Coding

Vibe coding is building software by telling an AI what you want, running what it writes and never reading the code. Great for a prototype, risky with customers.

TechnologyIntermediate

Technical Debt

Technical debt is the future work created by choosing a quick code solution today over the right one. Unpaid, the interest builds and development slows.

Quick check

Which login setup protects your shop's admin panel best?

Choose an answer

Frequently asked questions

Do I need to understand authentication before I start my business?
The idea, yes: it is how any system checks that the person logging in is really them. It matters first for your own accounts, the business email, the bank and the ad accounts, long before you build a login for customers.
When does authentication first become relevant for a new business?
On day one, for your own accounts. For your product, the moment customers can create accounts, save details or buy.
What does a secure login take to set up?
Site builders and platforms such as WordPress or Shopify come with a login built in. For a custom app, an established login service is usually cheaper and safer than building one, because a login written from scratch is where security holes appear.
Should I let customers sign in with Google or Facebook?
It can make signing up easier and spares you storing passwords, but it ties your customers' access to that provider, and a hijacked provider account becomes a way into yours. Offer it next to an email login, not instead of it.
Why does authentication matter for a business already running?
Weak logins let attackers take over customer accounts, steal data and place fraudulent orders, and your business carries the responsibility and the cost of cleaning up.
What goes wrong when a business writes its own password storage?
Passwords end up stored as readable text or with weak hashing, and one database leak exposes every account. Use a tested library or a login service instead.
How do I add two step verification without annoying customers?
Make it optional for customers and required for staff and admins. An authenticator app or a passkey takes seconds once it is set up. SMS codes are better than nothing, but NIST now classes them as a restricted method.
How do I know if my login page is under attack?
Many failed logins in a short time, often from a few addresses, point to automated guessing. Ask the developer to limit attempts, add alerts and block repeat offenders. That reduces the risk, it does not end it.
What does authentication actually mean in plain words?
Proving you are you. The system asks for proof, a password, a code from your phone or your fingerprint, and lets you in only if it matches.
Do strong passwords still need symbols and monthly changes?
No. The current NIST standard says not to force symbol rules or periodic changes without evidence of a breach. It asks for length and a check against passwords already known to be common or leaked.
What is a passkey?
A login credential stored on your phone, your computer or a security key, which lets you sign in the same way you unlock the device. The FIDO Alliance calls passkeys phishing resistant, because there is no password to type into a fake site.
What is the difference between authentication and authorization?
Authentication checks who you are, like showing your ID at the door. Authorization decides what you may do inside, like the ticket that lets you into the VIP area. Logging in is authentication, permission to see payouts is authorization.

Sources: NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, July 2025 (pages.nist.gov/800-63-4/sp800-63b.html), section 3.1.1.2 read 23 September 2026, FIDO Alliance, Passkeys (fidoalliance.org/passkeys), read 23 September 2026, Israel National Cyber Directorate, cyber protection guide for small businesses (gov.il), June 2018

Last reviewed: 2026-09-23

I have worked with

What Clients Say

From different fields, at different stages of business

Dan Manto

Eclipse Capital

Real Estate Investment and Finance, USA

Arty McLabin

GameReady

Game Development Education and Outsourcing, International

Anna, Beautician

Anna

Beautician

After I finished a cosmetology course at a leading company, I was confused. I didn't know how to open a business, what to sell from home, or how to bring in clients. Since I reached out to Mobius, everything has changed. We built an organized plan with clear steps and no unnecessary risks. Today I see results, and I'm growing and developing every month.

Mark, Massage therapist, Gan Yavne

Mark

Massage therapist, Gan Yavne

When I finished a massage course, I imagined a different world. I found out it's a hard field, and financial stability isn't easy to find. When I came to Mobius, something changed. We started an organized process and built a business plan. Without Mobius? I probably would have given up. Today I believe in myself and in my own path.

Tech decisions bigger than your team?

Alex helps Israeli businesses choose technology that fits the business, not the hype. The first call is free.

+972 055-248-6151. Better on WhatsApp: I am in meetings most of the day and answer as soon as I am free.