In authentication, which of the following represents something you have?

A password is a 'something you know' factor because it is a secret that is memorized, not a physical or digital object that must be possessed.

A fingerprint is a 'something you are' factor because it is a biometric characteristic inherent to the user's physical body.

A token - whether a hardware security key, smart card, or software-based OTP token - is a physical or digital artifact that must be in the user's possession to authenticate. This directly maps to the 'something you have' authentication category as defined in authentication factor taxonomy. Tokens are distinct from knowledge-based factors because possession, not memorization, is required.

A PIN is a 'something you know' factor because it is a numeric secret stored in memory, functionally equivalent to a password in authentication factor classification.