Authentication verifies a user's identity, typically with a username and password. The server never stores the password in plain text but a salted hash produced by a suitable algorithm (bcrypt, argon2). After login, it gives the client a session credential, such as a cookie.