NIST SP 800-63B authentication and lifecycle management
Documents authentication assurance, subscriber accounts, authenticator issuance, return-visit authentication, one-time-service account-avoidance context, MFA and phishing-resistant options, protected channels, privacy requirements, and customer-experience considerations for authentication services.
What this source can teach
Use this source to check a technical or accessibility requirement against its exact wording and scope.
- Start with the original. Open the source and find the guidance or example relevant to your task.
- Trace the connection. Use the claim notes below to see how this site applies the source to specific patterns.
- Check the setting. Compare the source's platform, people, and constraints with your own decision.
Pattern Decisions This Source Supports
| Pattern | Supported decision | Required contract | Claim note |
|---|---|---|---|
| Account creation | Choose account creation when a persistent account is required for repeated access, saved data, account management, security, authorization, legal accountability, or returning to drafts. | The flow states why the account is needed before asking for credentials. | NIST supports the account and authenticator lifecycle framing for repeated authentication and return visits. |
| Sign in | Choose sign in when the user needs to start or restore an authenticated session for an existing account. | The sign-in form identifies the protected service or destination before requesting credentials. | NIST supports authentication assurance, phishing-resistant options, protected channels, and reauthentication boundaries. |
| Two-factor authentication | Choose two-factor authentication when the user must satisfy an additional factor after a primary credential, SSO return, passkey flow, risk signal, new device, or sensitive action. | The challenge appears only when the server requires additional verification and the protected action remains blocked until success. | NIST supports authentication assurance, MFA options, phishing-resistant authenticators, protected channels, authenticator lifecycle, and customer-experience considerations. |
Comparisons supported by this source
- Account creation vs start page vs onboarding vs password creation
NIST supports account lifecycle and authentication assurance framing, including avoiding persistent authentication for one-time services where it is not needed.
- Sign in vs account creation vs password input vs session timeout warning
NIST supports authentication assurance, protected channels, phishing-resistant options, and reauthentication boundaries.
- Two-factor authentication vs sign in vs login vs password reset
NIST supports authentication assurance, MFA options, phishing-resistant authenticators, protected channels, authenticator lifecycle, and user-experience considerations.
Evidence Role
This source is treated as spec evidence. Its value comes from the specific claims and setting described above.
Publisher: National Institute of Standards and Technology. Last checked: .