Authentication Factors & Password Hashing | AP Cybersecurity
Authentication Factors & Password Hashing Explained
Topic 4.2 covers how a device verifies who you are. It includes the authentication factors, why passwords are stored as hashes rather than plain text, and the login settings that make a device harder to break into.
Contents
The four authentication factors
The framework lists four factor categories: something you know (a password, PIN, or challenge answer), something you have (a device or token), something you are (a biometric), and somewhere you are (a location factor). Combining factors from different categories is multi-factor authentication.
A knowledge factor only works if it is hard to guess, which is why weak or reused passwords are a core vulnerability.
A login requires a password and a fingerprint. Which factor categories are combined?
Reveal answer
Something you know (password) and something you are (fingerprint). Because they come from different categories, this is multi-factor authentication.
The framework names four factors, adding location (somewhere you are) to the usual three. Two items from the same category are not multi-factor.
Why passwords are hashed
Systems do not store your actual password. They store a hash of it (also called a checksum, message digest, or digest). A hash is a one-way transformation: the system hashes what you type and compares it to the stored hash, so the plain password is never kept.
If a database leaks, attackers get hashes, not passwords, which buys protection, especially for strong, unique passwords. Login settings like account-lockout policies further limit password guessing.
Why is storing password hashes safer than storing the passwords themselves?
Reveal answer
A hash cannot be easily reversed to the original password, so if the database leaks, attackers get hashes rather than usable passwords, especially when the passwords are strong.
Why leaked databases expose hashes, not passwords
When a breached site has stored passwords as hashes, attackers get the hashes, not the plaintext. Strong, unique passwords resist being cracked from those hashes, which is the whole point of hashing.
Hashing protects passwords at rest.
Key Terms
| Authentication factor | A category of proof: know, have, are, or where. |
| Hash | A one-way fingerprint used to store passwords. |
| Account lockout | A setting that limits failed login attempts. |
| Biometric factor | Something you are, like a fingerprint. |
Match It Up
Common Mistakes
Forgetting the fourth factor
The framework lists four factors, including location, not just three.
Thinking hashing is encryption
Hashing is one-way; you cannot decrypt a hash back to the password the way you can with encryption.
Assuming a hash makes weak passwords safe
Weak or common passwords can still be cracked from hashes; strength still matters.
Ignoring lockout policies
Account-lockout settings limit how many guesses an attacker gets.
Check for Understanding
Frequently Asked Questions
Get in Touch
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
Prefer email? Reach me directly at [email protected]