6 min read
Authentication vs authorization
Two questions, not one
When you use almost any system, it quietly asks two different questions. First, "who are you?" Second, "what are you allowed to do?" These get lumped together as "logging in", but they are separate steps, and keeping them apart makes a lot of security clearer.
Authentication: proving who you are
Authentication is how you prove your identity. It is the moment you show that you really are the person the account belongs to. Usually that means something you know (a password), something you have (a phone or a security key), or something you are (a fingerprint or your face). Adding a second of these is exactly what multi-factor authentication (MFA) does, which is why it is so effective: even a stolen password is not enough on its own.
Everyday version: showing your ID card at a door proves who you are. It does not, by itself, say which rooms you may enter.
Authorization: deciding what you may do
Authorization is the step after that. Once the system knows who you are, it decides what you are allowed to reach. A cashier and a manager might log into the same till system, but the manager can issue refunds and the cashier cannot. Same building, same front door, different permissions inside.
The order always matters: authentication first, then authorization. The system establishes who you are, and only then works out what that person is allowed to do.
Why the difference matters
Mixing the two up leads to real mistakes. "I logged in, so I should be able to see everything" confuses proving identity with being granted access. They are meant to be separate, so that being a valid user does not automatically mean being allowed to do everything. A visitor pass proves you are an expected guest; it still does not open the server room.
Signing in once: SSO
You have felt these two steps working together with single sign-on (SSO), where one login lets you into many connected apps. Think of "continue with Google", or a work account that opens email, chat and files without a fresh password each time. You authenticate once with the main provider; each app then authorizes you based on that trusted identity. It is convenient, and it means fewer passwords to manage, which is why protecting that one main account with a strong password and MFA matters so much.
Try this now
Open one account's settings and find where it proves who you are (login) versus what you are allowed to do (roles or permissions).
Check yourself
Where this lesson comes from
Built from
- Workshop 1: Cybersecurity Essentials (participant guide V3.0): authentication and authorization
alphaPlan courses are built from taught programmes rather than invented for the web. Where a claim rests on an outside standard or a reported case, it is named above so you can check it rather than take our word for it.
shënim: ky material u krijua në kuadër të projektit 'U.S. Cybersecurity Leadership in AI for Albania', financuar nga departamenti i shtetit i shteteve të bashkuara. mendimet, gjetjet dhe përfundimet e paraqitura këtu janë të autorit(ëve) dhe nuk pasqyrojnë domosdoshmërisht ato të departamentit të shtetit të shteteve të bashkuara.
Disclaimer: This material was created on behalf of the 'U.S. Cybersecurity Leadership in AI for Albania' project, funded by the United States Department of State. The opinions, findings, and conclusions stated herein are those of the author(s) and do not necessarily reflect those of the United States Department of State.
DisclaimerFound something unclear, outdated or improvable? Suggest an improvement