Cryptographic authentication is a login method that proves identity with public-key cryptography instead of a reusable shared secret like a password. A device keeps a private key hidden, while a server stores the matching public key. During sign-in, the service sends a challenge that the device can answer only by using the private key, which never leaves the device. That means there is nothing useful for an attacker to steal directly from the login exchange.
This matters because it greatly reduces common attacks such as phishing, password reuse, replay attacks, and credential stuffing. In real defenses, it appears in passkeys, hardware security keys, and other public-key sign-in systems. In attacks, criminals often try to bypass it by taking over the device, tricking a user into approving a prompt, or abusing weak recovery flows. For security teams, cryptographic authentication improves account protection only when the private key is well protected and recovery options are harder to guess than a simple PIN or password.