What is a credential (Identitätsnachweis) in the sense of authentication?

A set of data, never hardware or another physical container, that binds a digital identity, via its identifier, to an authenticator controlled by the subject; the verifier uses it together with the authenticator's output to check the claimed identity.

Typical credentials:

• the hash of a password, stored by the verifier;
• a biometric template, a stored reference image or feature set of a fingerprint or face;
• a certificate, which binds a name to the public key matching the private key on a smartcard.

The phrase "no hardware" is the key to the definition: the smartcard is the authenticator, the certificate on file is the credential. The credential is data that lets the verifier recognise the authenticator's output as belonging to one specific identity, and the identifier (a user name, an account number, the subject name in a certificate) is what links the two.

Because the credential stays registered, the subject can authenticate again and again simply by proving possession of the authenticator.

Beware of two other uses of the word: in everyday speech "credentials" often means "user name and password", and in self-sovereign identity a verifiable credential is a signed set of claims held by the user. Here the word means the verifier's reference data.

Go deeper:

• NIST SP 800-63B-4: Glossary — the formal definitions of credential, authenticator and authenticator output.