Authentication Factors
Categories of authentication evidence.
The categories of evidence used to prove identity: something you know, have and are, plus the contextual signals of location, time and behavior that risk-based systems add. Each row lists typical examples so a design can say which factors it actually combines.
Use it when
- You are designing or auditing multi-factor authentication and need to confirm the factors are genuinely different.
- You are explaining why two passwords are not two factors.
Watch out for
- Two items from the same category do not make multi-factor authentication.
- Location, time and behavior are usually risk signals that adjust a decision, not standalone factors.
The data
6 rows
| Factor | Examples |
|---|---|
| Knowledge | Passwords, PINs, security questions |
| Possession | Hardware tokens, smartphones, smart cards |
| Inherence | Fingerprints, facial recognition, voice prints |
| Location | IP address, GPS coordinates |
| Time | Time-based one-time passwords, access windows |
| Behavior | Typing rhythm, mouse movement, gait, device-usage patterns (used as continuous, risk-based signals) |
Fields
The shape of this dataset, read from the data itself: every column, its type and a real value. Agents can use this to plan a query without fetching the whole document.
| Section | Field | Type | Example |
|---|---|---|---|
| data | factor | string | Knowledge |
| data | examples | string | Passwords, PINs, security questions |
Fetch the same bytes
The static files contain the same reference rows as the API, with no API rate limit. Live metadata, such as view counts, may differ. Use the API for content negotiation; use the static files for a cacheable snapshot.
curl "https://yjtoon.com/api/dataset/authentication-factors?format=toon"
const res = await fetch( "https://yjtoon.com/static-data/dataset/authentication-factors.toon" ); const toon = await res.text();
Rate limit: 120 requests per minute per IP, no key and no signup. API reference →