User authentication is crucial for maintaining privacy. However, most existing methods are designed for single-user scenarios and may not be efficient for multiple users. To address this issue, we propose M-Auth, a ultiuser Auth entication system that utilizes a commercial mmWave radar to detect the unique breathing pattern. We exploit the phenomenon that chest movements due to breathing can alter radio frequency (RF) signals. To make M-Auth more effective in capturing signals from multiple users, we design an auxiliary rotating gadget to adjust the radar orientation dynamically. By using mmWave’s high directivity, we can isolate individual components from blended RF signals and focus on reflections from different positions. We propose an energy comparison method to filter out irrelevant body movements and retain fine-grained respiration traits. Subsequently, we develop a feature selection pipeline to extract the most informative features and train a machine learning-based classifier to identify each user. M-Auth is practical because it is noncontact and passive, and it is secure because respiration is unique and challenging to forge. Extensive experiments with 37 participants demonstrate that M-Auth is effective in verifying legitimate users and thwarting spoofing attacks, with an authentication accuracy of over 96% and an attack detection rate of over 95%.