Authentication factor
An authentication factor is a category of evidence used to authenticate a person, such as something they know, something they possess, or a biometric characteristic.
Factor and authenticator mean different things
The factor is the kind of evidence a sign-in uses. The authenticator is what supplies it. A password supplies knowledge; a security key supplies possession of a key. A biometric comparison uses a physical characteristic, such as a fingerprint.
One device can supply more than one factor. A cryptographic authenticator that requires a PIN can combine possession with knowledge. Under NIST’s rules, a biometric is used with a physical authenticator, rather than serving as an authenticator by itself.
What to ask about a sign-in method
Ask which factors the method demonstrates and how. Counting devices or prompts can give the wrong answer. Two password prompts still ask for the same factor type.
Then consider phishing resistance. Microsoft’s method comparison distinguishes phishing-resistant methods from code and push methods. Knowing that a sign-in used two factors is useful, but it does not tell you whether an impostor website could capture or relay what the user provides.