Users of an online system are authenticated based on signatures of cameras that were used to capture images uploaded to the online system. Users of an online system upload photos taken from their cameras. The online system extracts characteristic information about the camera that captured the photos. This information includes a mapping of faulty pixels, metadata included with the photos, a naming convention, and the like. The online system stores an association between the user and the camera. This association is used for authentication of the user. For authentication, the user is asked to upload new photos taken from the camera that the user used previously. The information extracted from the newly uploaded photos is matched against stored information of cameras used previously by the user. The user is successfully authenticated if the camera used for the newly uploaded photos matches a previously stored camera.