What is an authenticator (Authentifizierungsmittel)?

Information and/or a process that can be used to authenticate a subject; it relies either on one factor (single-factor authenticator, SFA) or on several independent factors (multi-factor authenticator, MFA).

Typical authenticators are a password, a list of one-time codes, an authenticator app, a security key or a smartcard. What they have in common is that the subject possesses and controls them and can use them to produce something the verifier can check.

The definition says "information and/or process" on purpose:

• A password is pure information: knowing it is the whole authenticator.
• A smartcard is a process around a secret: a chip that computes a signature with a key nobody can read out.

Common synonyms are authenticator and authentication token; earlier editions of NIST SP 800-63 used the word token, and German texts also say Authentifikator.

Tip: Do not confuse the authenticator (what the subject holds) with the credential (what the verifier stores to check it); see the credential card.

Go deeper:

• NIST SP 800-63B-4: Requirements by authenticator type — the catalogue of authenticator types, from passwords to multi-factor cryptographic devices.
• Security token (Wikipedia) — the many physical and software forms an authenticator can take.