A storage device is provided. The storage device includes: a nonvolatile memory including memory cells divided into first and second memory cell groups; a memory controller; and a physically unclonable function (PUF) circuit configured to generate PUF data, based on an output of the second memory cell group, by excluding, from the output of the second memory cell group, outputs of a first exclusion area, a second exclusion area, and a third exclusion area, The first exclusion area has a threshold voltage equal to or greater than a first read level and less than a second read level, the second exclusion area has a threshold voltage less than a third read level that is less than the first read level, and the third exclusion area has a threshold voltage equal to or greater than a fourth read level that is greater than the second read level.