Credential

Everyday usage treats "credential" as anything used to log in, but NIST SP 800-63-3 draws a sharper line. There, the authenticator is what the claimant possesses and controls (a password, an OTP device, a private key), while the credential is the object or data structure that authoritatively binds an identity, via one or more identifiers, to at least one authenticator. In that strict sense an X.509 certificate is a credential, since the CA's signature binds a subject name to a public key, and the matching private key is the authenticator. The distinction matters when reading standards, even though most product documentation uses the looser meaning.

Technically, credentials fall into three families. Shared secrets, such as passwords, PINs, API keys, HMAC keys and TOTP seeds (RFC 6238), require the verifier to hold something derived from the same secret, so a breach of the verifier's store enables offline cracking or direct reuse. Asymmetric credentials, such as TLS client certificates, SSH keys and FIDO2 passkeys, leave the verifier holding only a public key, so its compromise yields nothing usable for logging in. Derived bearer credentials, such as session cookies, OAuth access and refresh tokens and Kerberos tickets, are issued after authentication and grant access to whoever presents them unless they are sender-constrained, for example with mutual TLS (RFC 8705) or DPoP (RFC 9449).

Handling rules follow from that split. Human secrets are stored as salted, slow hashes; machine secrets belong in a secrets manager or are replaced with short-lived credentials from a token service or workload identity federation; private keys should be non-exportable inside a TPM, secure enclave, smart card or HSM. Static cloud access keys committed to source control are a recurring cause of breaches, which is why secret scanning in CI and in repository hosting is now standard. Every credential needs a lifecycle: issuance, binding to the account, renewal, revocation (CRLs or OCSP for certificates) and prompt invalidation when compromise is suspected.

MITRE ATT&CK groups the attacker side under the Credential Access tactic (TA0006), including Brute Force (T1110, with Credential Stuffing as T1110.004), OS Credential Dumping (T1003, for example reading LSASS memory with Mimikatz), Credentials from Password Stores (T1555), Unsecured Credentials (T1552) and Steal Web Session Cookie (T1539). Infostealer malware harvests browser-saved passwords and session cookies in bulk, so a credential can be stolen without any phishing page. A credential proves control of an identity; it does not itself carry permissions, which are attached to the account it unlocks.