“Something you know” authentication refers to knowledge-based credentials such as passwords, PINs, or passphrases. This is widely regarded as the weakest form of authentication because it is highly susceptible to compromise through phishing, brute-force attacks, credential stuffing, shoulder surfing, and social engineering.

Passwords can be guessed, reused, written down, or stolen through malware and data breaches. Users often choose weak or reused passwords, further reducing security. Even when password complexity rules are enforced, attackers frequently bypass them using previously leaked credentials.

In contrast, “something you have” (tokens, smart cards), “something you are” (biometrics), and biometric authentication provide stronger assurance because they are harder to steal or replicate. Modern security standards recommend combining factors using multi-factor authentication (MFA) to reduce reliance on knowledge-based authentication alone.

NIST SP 800-63 explicitly discourages password-only authentication for sensitive systems, emphasizing that “something you know” should be augmented with additional factors whenever possible.