Credentials

When you log in to an online service, you have to prove that you really are you. To do that, you provide something that only you should know or possess. That is exactly what credentials are, in German 'Zugangsdaten'. The classic example is the combination of username and password. But there are other forms too: a long string of characters that a program presents instead of a password, a certificate on the device, or a fingerprint. What they all have in common is their purpose: they are meant to prove that access is authorized.

Why stolen access data is the most common entry point for break-ins

For attackers, credentials are the most attractive target of all. A genuine login is more convenient than any technical security flaw. Anyone who logs in with correct data looks to the system like a normal user. There is no alarm, no suspicious file, no crash. Security reports from major providers have named stolen or guessed access data as one of the most common causes of data breaches for years.

The problem is amplified by human behavior: many people use the same password across multiple services. If a small online shop gets hacked, the captured combinations end up in lists. Attackers automatically try these lists against banks, email providers, and company portals. This approach is called credential stuffing. It already works well if only a fraction of users reuse their password multiple times.

In companies, a second layer comes into play. It’s not just people who have credentials, but also programs, servers, and AI systems. Such machine credentials often sit in configuration files or in program code. If they are accidentally published, for example in an openly accessible code repository, anyone can collect them. Automated search tools scan the internet specifically for such finds.

From password to token: how the proof works technically

A well-built service does not store your password in plain text. Instead, it calculates a checksum from it, called a hash. This is a string of characters from which the original password can practically not be reconstructed. When logging in, the password you enter is run through the same calculation again. If the results match, you’re in. Even if attackers steal the database, all they get are the hashes.

After logging in, most systems no longer use the password. You receive a token: a time-limited string that is sent along with every further request. Think of it like the wristband at a festival. At the entrance, you were checked once, after that the wristband is enough. If it expires, you have to identify yourself again. API keys for programs work similarly, but are often valid for a very long time.

Because a single proof can easily be stolen, several types are combined. With two-factor authentication, you need something you know and something you possess. So a password plus a code from an app. Passkeys go even further: there, the actual secret key stays on your device and is never transmitted. An attacker can then not intercept it on a phishing site.

Credentials in news, cloud services, and AI tools

In business news, credentials usually appear in connection with security incidents. Phrases like “attackers gained access via compromised credentials” simply mean: someone had a valid password. For companies, this is costly because it often leads to data breaches and reporting obligations. An entire market of software is dedicated to centrally managing access data and rotating it regularly.

You also encounter the term when working with AI. Anyone using a language model via an interface receives an API key from the provider. This key is a credential and, at the same time, a billing address: every request costs money. If the key becomes public, others run up charges at your expense. That’s why providers explicitly warn against embedding such keys in apps or websites.

In everyday life, a password manager helps most of all – a program that generates and stores a unique long password for each service. A common misconception is that complicated characters matter more than length. In fact, a long password protects better against automated guessing. And: no matter how good a password is, it won’t help if you voluntarily enter it on a fake login page.