Password & security
terms, explained

A mathematical measure (in bits) of a password's unpredictability against brute-force attacks.

A trial-and-error method using automated scripts to guess every possible character combination.

A hacking technique that attempts thousands of dictionary words and common variations to crack passwords.

A precomputed table mapping hash outputs back to candidate passwords, letting an attacker look up a match instead of computing hashes live. It only works against fast, unsalted hashes — a properly salted hash (see Salting) defeats rainbow tables entirely, since a unique salt forces a fresh table per password.

Unencrypted, human-readable text before it undergoes cryptographic hashing or encryption.

A one-way cryptographic representation of a password stored in databases for secure matching.

Adding random string data (salt) to a password before hashing to prevent rainbow table attacks.

An application-wide secret value — unlike a per-password salt — stored separately from the password database (e.g. in app config, an environment variable, or an HSM) and combined with a password before hashing. If the database leaks but the pepper doesn't, offline cracking is far harder.

A widely used general-purpose cryptographic hash function producing a 256-bit digest. It's fast — which makes it a poor choice for hashing passwords on its own, since that speed lets attackers try billions of guesses per second. Purpose-built password hashes like bcrypt or Argon2 are deliberately slow instead.

A key-derivation function designed for password hashing that includes salt and configurable work factor.

The winner of the Password Hashing Competition (PHC), optimized to resist GPU and ASIC cracking.

Password-Based Key Derivation Function 2; applies a pseudorandom function repeatedly to increase hash calculation time.

Replacing standard characters with visually similar numbers/symbols (e.g., P@ssw0rd), easily guessed by modern tools.

The pool of characters (uppercase, lowercase, digits, special symbols) available to construct a password.

An estimation of how long modern GPU clusters take to exhaustively search a password's search space.

Techniques used to make a weak password more secure by repeatedly hashing or stretching the key.

Sequential key strokes on QWERTY or keypad layouts (e.g., qwertyuiop, 1qaz2wsx) that lower entropy.

Cyberattacks aimed at collecting credentials via spoofed interfaces or keystroke logging.

Utilizing parallel GPU processing pipelines to test billions of password hashes per second.

A targeted brute-force attack specifying exact structural rules (e.g., Upper + Lower + 4 Digits).

Transforming dictionary wordlists using automated rules (e.g., capitalization, appending digits).

A cryptographic method letting one party prove a statement is true to another party without revealing any information beyond the statement's truth. Applied to authentication, it can prove you know a password or secret without ever transmitting or exposing the secret itself.

Processing and analyzing password input within the browser using JavaScript without network delivery.

An open-source password strength estimator based on pattern matching and conservative entropy calculations.

Automated injection of stolen username/password pairs across multiple online portals.

Cryptographically Secure Pseudorandom Number Generator; generates unbiased, unpredictable values.

A sequence of random words concatenated together to form a long, highly memorable, high-entropy secret.

A methodology that uses physical dice rolls mapped to a wordlist to select truly random passphrase words.

Numbers that appear random but are generated by a deterministic algorithm initialized by a seed.

An initial value used to start a pseudorandom number generator algorithm.

Randomness harvested from unpredictable physical processes — electronic thermal noise, clock jitter, disk timing, or similar — used to seed a cryptographically secure random number generator so its output can't be predicted or reproduced.

Visually similar symbols (0, O, 1, l, I) often excluded from generated passwords to avoid confusion.

Software that encrypts, stores, and auto-fills complex passwords inside a secure vault.

The primary master key used to encrypt and decrypt a user's password vault.

Passwords built with alternating consonant-vowel combinations to aid short-term memory recall.

The cryptographic consensus that increasing string length builds exponential security faster than complex character mixes.

Advanced Encryption Standard with a 256-bit key, widely used to encrypt password vaults.

Data protection ensuring credentials are encrypted on the sender's device and decrypted only by the recipient.

Extracting stored credentials from a password manager in formats like CSV or JSON.

Browser features that automatically populate saved credentials into detected login forms.

A piece of information used by an algorithm to lock or unlock encrypted data.

A passwordless authentication standard based on FIDO2/WebAuthn public key cryptography.

Asymmetric encryption using a public key for encryption and a private key for decryption.

A web standard published by the W3C allowing web apps to authenticate users with public key cryptography.

An open authentication standard that enables users to leverage common devices to authenticate to online services.

Encryption where the same key is used for both encoding and decoding data.

Encryption that uses a mathematically linked pair of public and private keys.

Deriving one or more secret keys from a master secret like a passphrase using a KDF.

A piece of confidential information that controls access to encrypted data or authentication tokens.

A temporary cryptographic key generated for a single session to ensure forward secrecy.

An incident where confidential information is accessed, stolen, or exposed without authorization.

A public security service allowing users to search if their email or password was involved in a leak.

A privacy model that transmits only the first 5 characters of a SHA-1 hash to verify leaks anonymously.

Automated services that scan breach dumps, paste sites, and illicit marketplaces for exposed emails, credentials, or other personal and business data, alerting the owner so they can respond before the exposure is exploited.

The risky practice of using identical passwords across multiple services.

Extracting logon credentials, hashes, and tokens from system RAM or domain controllers.

Testing a single common password against hundreds of user accounts to bypass lockouts.

A consolidated collection of hundreds of previous breach dumps merged into a single searchable text file.

Reviewing enterprise Active Directory user accounts for weak, expired, or breached passwords.

The unauthorized copy, transfer, or retrieval of sensitive account data from a system.

A database containing hundreds of millions of real-world passwords exposed in previous data breaches.

Deceptive social engineering attacks designed to trick users into revealing sensitive credentials.

Highly targeted phishing attempts customized against specific high-profile individual accounts.

Phishing attacks executed through text messages (SMS) to trick mobile phone users.

Voice phishing attacks conducted via phone calls to manipulate victims into sharing login details.

Malicious software or hardware designed to secretly record every keystroke pressed on a device.

An attack where a threat actor secretly intercepts and alters communications between two parties.

Exploiting a valid computer session to gain unauthorized access to data or services.

Stealing session tokens or cookies to bypass password prompts and multi-factor authentication.

The fraudulent acquisition and use of a person's private identifying information for financial gain.

Formal communication required by regulations informing users their credentials were compromised.

Usernames and plain text/hashed passwords made publicly downloadable on illicit web forums.

An attack scenario where a hacker illegally gains ownership of an authentic user's account.

A security flaw known to attackers before the vendor releases a corrective software patch.

Malware explicitly coded to extract saved web passwords, session cookies, and crypto keys from devices.

A numeric passcode used to authenticate users on cellular devices, ATMs, and access cards.

The set of 10,000 possible mathematical variations (10^4) ranging from 0000 to 9999.

The set of 1,000,000 possible mathematical variations (10^6) ranging from 000000 to 999999.

Capturing heat signatures left behind on physical buttons immediately after a user types a PIN.

Directly observing someone's screen or physical keypad movements to steal their passcode or PIN.

Enforcing exponential delays or permanent hardware wipes after a set number of failed PIN attempts.

A security passcode designed to lock a mobile phone's SIM card against unauthorized network access.

Using physical biological characteristics (fingerprints, facial features) to unlock systems.

Apple's biometric fingerprint authentication technology used on iPhones, iPads, and MacBooks.

Apple's facial recognition system utilizing structured light and infrared camera sensors.

A grid-based geometric shape drawn on touchscreen devices to unlock operating systems.

A device protection state requiring a PIN, password, pattern, or biometric verification to dismiss.

A hardware-isolated coprocessor designed to manage biometrics and key security out of OS reach.

A physical computing device that safeguards and manages digital keys for strong authentication.

PINs built from repeated or mirrored digit sequences (e.g. 1212, 4545, 1221) — far easier to guess than their 4- or 6-digit search space suggests, since attackers try these patterns first.

Attaching fraudulent hardware to card readers to covertly capture debit card data and PINs.

Securing private branch exchange telephone networks from unauthorized remote dial-out fraud.

Device security options provided on Android phones including PINs, passwords, and Smart Lock features.

The primary numerical key mechanism used to secure Apple mobile devices.

A secondary PIN programmed to unlock a device while covertly triggering a silent panic alert.

A secondary authentication code requested when primary biometrics fail or post-reboot.

Displaying keypad numbers in shuffled locations on screen during each prompt to prevent pattern reading.

Reconstructing touch patterns on dirty touchscreen glass surfaces to guess screen unlock PINs.

Scrambling stored mobile storage drive content accessible only when unlocked with the user's PIN.

PIN Unlocking Key; a unique code provided by cellular carriers to unlock a SIM card blocked by incorrect PINs.

Wi-Fi Protected Access 3; the newest wireless security protocol featuring SAE protection.

A wireless security standard relying on a single pre-shared key (PSK) using AES encryption.

Service Set Identifier; the technical identifier broadcasted to distinguish a specific wireless local area network.

A shared secret key previously agreed upon between wireless access points and client devices.

Wi-Fi Protected Setup; an insecure feature enabling connection via a button press or easily cracked 8-digit PIN.

A structured barcode containing SSID and encryption specs enabling instant mobile network joins.

The frame exchange process that establishes encryption keys without transmitting the main password over air.

Simultaneous Authentication of Equals; a key exchange protocol in WPA3 that eliminates offline dictionary attacks.

Transmitting spoofed deauth frames to force connected devices off a WiFi network to capture handshakes.

An unauthorized wireless router connected to an enterprise network without administrator consent.

A fraudulent wireless access point masquerading as a legitimate network to intercept user credentials.

The local IP address (e.g., 192.168.1.1) used to access a router's admin configuration console.

Factory credentials assigned to new routers that must be changed during initial deployment.

An isolated sub-network configured on routers to give visitors internet access without local LAN visibility.

A network access policy restricting connectivity based on physical network interface card addresses.

A web page presented to newly connected wireless users requiring authentication before internet access.

Temporal Key Integrity Protocol; an obsolete, weak wireless encryption protocol formerly used to patch WEP.

Wired Equivalent Privacy; an outdated, vulnerable legacy wireless security algorithm that can be cracked in minutes.

Periodic broadcast management frames transmitted by access points to announce network presence.

Disabling inter-client communication on a router to prevent local peer device snooping.

A central authentication backend used by WPA2/WPA3 Enterprise systems to manage user credentials.

Moving through geographic areas in vehicles while scanning and mapping vulnerable or open WiFi networks.

Monitoring airwaves with specialized tools to intercept unencrypted wireless data packets.

The IEEE wireless standard focused on speed, efficiency, and capacity in crowded networks, via OFDMA, MU-MIMO, and target wake time. WPA3 became a required Wi-Fi Alliance certification for new devices around the same period — and is mandatory for Wi-Fi 6E specifically — but WPA3 is a separate security certification, not literally part of the 802.11ax radio standard itself.

Disabling a router's beacon broadcast so its network name does not appear in standard network scans.

Two-Factor Authentication; requiring two distinct identity factors before granting account access.

Multi-Factor Authentication; verification requiring two or more independent credential categories.

Time-Based One-Time Password; a temporary verification code generated using a shared key and current time.

HMAC-Based One-Time Password; an event-based algorithm relying on an incrementing counter instead of time.

A popular mobile application used to generate and synchronize standard TOTP verification codes.

An authentication app offering cloud sync, push notifications, and TOTP generation.

A uniform resource indicator format standard encoding issuer, account name, and secret keys for QR codes.

A Base32-encoded cryptographic key shared between authentication servers and authenticator client apps.

A binary-to-text notation utilizing 32 ASCII characters (A–Z, 2–7) suitable for human typing and QR mapping.

A hardware security key supporting FIDO2, WebAuthn, and OTP protocols via USB or NFC.

Single-use passcodes generated during 2FA setup to regain account access if a phone is lost.

A scam where attackers trick mobile carriers into porting a phone number to bypass SMS 2FA.

Sending a prompt to a trusted mobile app asking users to explicitly approve or deny a sign-in attempt.

Prompt bombing; spamming target users with repeated push authentication requests until they approve.

Software installed on smart devices that acts as a local software token container for 2FA.

A condition where client device clocks drift out of sync with authentication servers, causing TOTP errors.

Sending dynamic verification codes through cellular SMS, vulnerable to SIM swaps and interception.

An authentication scheme allowing users to log in once and gain access to multiple related applications.

An identity layer built on top of the OAuth 2.0 framework allowing clients to verify end-user identity.

Security Assertion Markup Language; an open standard for exchanging authentication and authorization data.

An authorization framework enabling applications to obtain limited access to user accounts on an HTTP service.

A centralized system service that creates, maintains, and manages identity information for user accounts.

Verification requiring communication across two separate channel pathways (e.g., Internet + Cellular).

An authentication credential stored within a mobile app or computer soft-client rather than hardware keys.

A physical electronic key fob or smartcard that generates or holds secure authentication data.

Creating large quantities of unique, high-entropy passwords simultaneously for enterprise onboarding.

Exporting structured comma-separated data containing usernames, emails, and generated credentials.

Formatting batch credentials into JavaScript Object Notation structures for automated API distribution.

Provisioning new organizational users with accounts, groups, and temporary initial access passcodes.

Short-lived initial login passcodes assigned to users, requiring an immediate reset upon first authorization.

Using Microsoft's task automation framework to generate user account batches in Active Directory.

Bulk generation of long, non-human-readable secret strings used to authenticate programmatic requests.

Files storing sensitive operational secrets, API keys, and database passwords separately from source code.

Tools and practices designed to securely store, rotate, and audit software development credentials.

Text-based tool interfaces allowing system administrators to trigger scriptable batch password commands.

Banning confusing, problematic, or code-breaking characters during high-volume generator batch runs.

Universally Unique Identifier; a 128-bit label used to identify computer information resources uniquely.

Memory and execution thresholds defined to prevent browser tab locking during client-side generation.

Permanently overwriting temporary CSV or text files containing newly generated batch passwords.

Managing user lifecycles across systems using centralized rule engines without manual IT intervention.

Regularly updating API keys, service passwords, and tokens systematically to minimize exposure windows.

Embedding plain text passwords directly into software code bases, creating severe security risks.

A non-human user account dedicated to running specific applications, automated scripts, or background tasks.

An asymmetric key pair (public/private) used to authenticate access to remote servers over SSH.

A cryptic string emitted by an authorization server passed in HTTP headers to access protected resources.

A compact, URL-safe means of representing claims to be transferred between two parties securely.

Storing newly computed batch values within browser RAM memory arrays before file download triggers.

Using regular expressions to mandate structural formatting and character bounds across batch output runs.

Methods used to deliver new initial passwords securely to end users without exposing them via plain email.

Redacting generated password output values from system console logs during batch provisioning executions.

The NIST Digital Identity Guidelines volume covering authentication and password policy. The current revision, SP 800-63B-4 (finalized 2025), recommends a 15-character minimum where systems allow it, prohibits mandatory periodic password expiration except after evidence of compromise, and requires screening new passwords against known-breached lists.

Payment Card Industry Data Security Standard; dictates security controls for processing payment card data.

The international benchmark standard outlining requirements for Information Security Management Systems.

US federal standards protecting individual electronic personal health information access controls.

The EU's General Data Protection Regulation, governing how organizations collect, store, and protect personal data — including requirements around data access rights, breach notification, and technical safeguards like credential protection.

A compliance audit report evaluating service organization operational controls over security and privacy.

Identity and Access Management; frameworks ensuring the right individuals have appropriate resource access.

A blacklisted directory of common words, dictionary items, and leaked credentials blocked by policy enforcement.

A strategic cybersecurity paradigm that operates under "never trust, always verify" principles.

Security policy mandating that users and services are granted only the minimum access necessary.

The legacy rule mandating scheduled resets, now advised against by NIST due to user habit degradation.

Active Directory rules permitting separate password complexity and lockout standards across distinct user roles.

Role-Based Access Control; restricting network access based on individual user roles within an enterprise.

Attribute-Based Access Control; granting access rights based on user, resource, and environmental attributes.

Privileged Access Management; specialized tools designed to safeguard, control, and monitor admin credentials.

Educating organization staff on password health, phishing detection, and safe digital practices.

Continuous automated verification ensuring security settings align with corporate and regulatory rules.

Simulated authorized cyberattacks against systems to evaluate security posture and credential resistance.

Chronological record keeping of system activities, access attempts, and administrative policy changes.

A list of permissions attached to an object specifying which users or processes are granted access.

Self-Service Password Reset; tools enabling users to reset forgotten passwords securely without calling IT.

Identity Governance and Administration; frameworks enabling policy compliance enforcement across identity systems.

Linking a user's identity across multiple distinct security domains and software organizations.

Dynamically requiring additional verification (like 2FA) when login attempts show unusual signals.

Policy enforcement mechanisms preventing users from recycling recently used passwords during resets.