Skip to main content
Commerce Security Authority
Category: Authentication Methods

Memorized Secret

Also known as: Memorized Secret Token, Password, Passphrase
Simply put

A memorized secret is a value, such as a password or passphrase, that a person remembers and uses to prove their identity when logging in. It is a secret shared between the user and the party that issued their account credentials. The idea is that it should be something a person can potentially remember, which sets it apart from a machine-managed cryptographic key.

Formal definition

In NIST SP 800-63B terminology, a memorized secret is an authenticator consisting of a secret shared between the subscriber and the credential-issuing party, typically a character string such as a password or passphrase. Its defining characteristic is that it is intended to be potentially memorable to a subscriber, distinguishing it from a cryptographic key that need not be human-memorable. A passphrase is a specific form of memorized secret composed of a sequence of words or other text, which may permit common punctuation such as spaces and periods to aid memorability. Memorized secrets are validated at authentication time by a verifier. Note that this term originates in the NIST digital identity framework and is distinct from PCI DSS authentication requirements; readers should confirm any related password or authentication control against the current published PCI DSS standard, as requirement numbering and wording differ between versions.

Why it matters

The memorized secret remains the most widely deployed authentication factor, and its terminology matters because it appears across identity frameworks, vendor documentation, and internal policies. Using the precise NIST SP 800-63B term rather than the informal word "password" helps teams reason about what the control actually is: a secret shared between the user and the credential-issuing party, intended to be potentially memorable. That memorability characteristic is exactly what distinguishes a memorized secret from a machine-managed cryptographic key, and it is also the source of its practical weaknesses, since human-chosen secrets are subject to reuse, guessing, and phishing.

Because a memorized secret is something a person knows, it represents a single knowledge factor. On its own it does not address risks such as credential theft, replay, or account takeover, which is why it is commonly combined with additional factors. Treating the memorized secret as one component of an authentication design, rather than as complete protection, helps teams avoid overstating the assurance a password alone provides.

It is important to keep frameworks separate. The term "memorized secret" originates in the NIST digital identity framework and is distinct from PCI DSS authentication requirements. Teams working on payment environments should confirm any related password or authentication control against the current published PCI DSS standard, since requirement numbering and wording differ between versions, rather than assuming NIST terminology and PCI DSS requirements are interchangeable.

Who it's relevant to

Identity and access management engineers
Engineers implementing login flows work directly with memorized secrets and their verifiers. Understanding the NIST SP 800-63B definition helps them design credential handling, including how a verifier validates a presented secret, and helps them treat passwords and passphrases as one factor within a broader authentication design rather than as complete protection.
Compliance officers
Compliance teams should recognize that "memorized secret" is NIST terminology and is distinct from PCI DSS authentication requirements. When mapping policies, they should confirm related password or authentication controls against the current published PCI DSS standard, since requirement numbering and wording differ between versions, rather than assuming NIST and PCI DSS terms align one to one.
Security architects
Architects deciding on authentication factors benefit from distinguishing a memorized secret, something a user knows and remembers, from a machine-managed cryptographic key. This distinction informs decisions about combining a knowledge factor with additional factors to address risks such as credential theft or account takeover that a memorized secret alone does not mitigate.

Inside Memorized Secret

Memorized secret
An authentication factor that a user recalls from memory, such as a password, passphrase, or PIN. It falls into the 'something you know' category of authentication factors.
Knowledge factor classification
A memorized secret is a knowledge factor, distinct from possession factors (something you have, such as a token or cryptographic device) and inherence factors (something you are, such as a biometric).
PIN as a memorized secret
A cardholder PIN is a memorized secret used to authenticate a cardholder. When entered and transmitted, the PIN is protected as a PIN block; the handling of PINs and PIN blocks is governed by the PCI PIN standard and related requirements, which are separate from the memorized-secret concept itself.
Role in multi-factor authentication
A memorized secret can serve as one factor in a multi-factor authentication scheme, but combining it with a second knowledge factor does not create multi-factor authentication because both factors would belong to the same category.
Storage protection expectation
Memorized secrets used for system authentication are expected to be rendered unreadable in storage using strong cryptography, commonly a salted one-way hash, so that the plaintext value is not retained. The specific requirement wording and numbering differ between PCI DSS versions and should be confirmed against the current published standard.

Common questions

Answers to the questions practitioners most commonly ask about Memorized Secret.

Is a memorized secret the same thing as a password?
A password is one common form of memorized secret, but the term is broader. A memorized secret is any secret value a person commits to memory and recalls to authenticate, which can include passwords, passphrases, or PINs used as knowledge-based factors. Using the general term helps avoid assuming a specific format, length, or composition rule, since those details depend on the applicable standard and implementation rather than on the label alone.
Does using a memorized secret by itself satisfy multi-factor authentication requirements?
No. A memorized secret is a single authentication factor from the something-you-know category. Multi-factor authentication requires factors from at least two distinct categories, such as combining a memorized secret with something you have or something you are. Presenting two memorized secrets, or a memorized secret plus a security question, does not constitute multi-factor authentication because both draw from the same knowledge category. Confirm the specific factor and combination requirements against the current published standard, since wording and expectations differ between versions.
How should a memorized secret be stored so it is not exposed if a system is compromised?
Memorized secrets should not be stored in a form that allows recovery of the original value. Practices generally involve storing a value derived through a one-way transformation rather than the secret itself, so that the stored value cannot be reversed to reveal what the user typed. The specific storage, transformation, and protection expectations depend on the applicable standard and implementation, so confirm the current requirements and their exact wording against the published standard rather than assuming a fixed rule.
Where do memorized secrets fit relative to cardholder data and sensitive authentication data?
A memorized secret used to log in to a system is an authentication credential and is distinct from payment data such as the PAN, cardholder name, expiration date, or service code. It is also distinct from sensitive authentication data such as full track data, card verification values, and PINs or PIN blocks used in a transaction. Treating an account login secret and a payment PIN as interchangeable can lead to misapplied controls, since they are governed by different handling and storage expectations.
What trade-offs come with enforcing complexity or rotation rules on memorized secrets?
Composition rules and forced periodic changes are intended to reduce the risk of easily guessed or reused secrets, but they can introduce trade-offs. Overly rigid rules may lead users to adopt predictable patterns or to reuse and write down secrets, which can weaken rather than strengthen security. The balance between usability and control strength, and the specific rules that apply, depend on the governing standard and the risk context, so confirm current expectations against the published standard rather than assuming a fixed policy.
Can a memorized secret be combined with other controls to reduce credential-based fraud?
A memorized secret can be paired with additional controls, such as a second factor from a different category, rate limiting, and monitoring for suspicious authentication attempts. These measures are intended to help reduce risks such as guessing, reuse, and account takeover, but no single control eliminates fraud. Each added control carries its own trade-offs, including potential false positives that block legitimate users and false negatives that miss malicious attempts, so layered controls should be tuned to the specific environment.

Common misconceptions

Requiring a password plus a security question counts as multi-factor authentication.
A password and a security question are both knowledge factors (memorized secrets), so combining them does not satisfy multi-factor authentication. MFA requires factors from at least two different categories, such as something you know plus something you have or something you are.
A memorized secret such as a PIN is cardholder data covered by the same storage allowances as a PAN.
A PIN is not stored cardholder data that may be retained under defined controls. PINs and PIN blocks are sensitive authentication data and must not be stored after authorization, even if encrypted. Their handling is also addressed by the PCI PIN standard, which is separate from PCI DSS.
Storing memorized secrets encrypted is equivalent to hashing them.
Encryption is reversible and preserves the plaintext value if keys are compromised, while a salted one-way hash is intended to make recovery of the original secret impractical. For authentication verification, a strong one-way hash is generally the expected approach rather than reversible encryption; effects on protection and scope depend on implementation and validation, not the label.

Best practices

Render stored memorized secrets unreadable using strong cryptography, typically a salted one-way hash, and confirm the exact expectation against the current published version of the applicable standard.
Do not store PINs or PIN blocks after authorization, and handle them in line with the PCI PIN standard rather than treating them as retainable cardholder data.
When implementing multi-factor authentication, combine a memorized secret with a factor from a different category (possession or inherence) rather than a second knowledge factor.
Avoid transmitting or logging memorized secrets in plaintext, and protect them in transit and at rest throughout the authentication flow.
Do not rely on a memorized secret alone to mitigate account takeover or fraud; it is one control among several and helps reduce, rather than eliminate, unauthorized access risk.
Verify the specific requirement wording and numbering that governs memorized-secret handling against the current standard, since these differ between PCI DSS versions.