The invention discloses an identity authenticating system and an identity authenticating method which are used for preventing shoulder surfing and are based on dynamic window passwords, and essentially solve the problem of bad shoulder surfing resistant performance of the existing identity authenticating system. The whole identity authenticating system comprises a user registration information database, an information encrypting and decrypting layer, a user identity authenticating module, a user registering module and an interacting layer; wherein, the information encrypting and decrypting layer respectively realizes duplex transmission with the user registration information database, the user identity authenticating module and the user registering module; and the interacting layer respectively realizes duplex transmission with the user registering module and the user identity authenticating module. During identity authentication, a user can choose to register or validate a login identity; for the user needing registration, password icon background color, security level and password icon are chosen; and for the user needing login identity validation, a validating interface composed of icon matrixes with multiple colors is loaded for password validation. The identity authenticating system and the identity authenticating method have the advantages of good shoulder surfing resistant performance as well as high usability and security, and can be used for identity authentication of input passwords in public places.