Password security glossary, without the jargon

Encryption applied on the sender's device and removed only on the recipient's, leaving intermediaries unable to read the content.

A one-way transformation that turns any input into a fixed-length fingerprint which cannot be reversed.

An algorithm that turns a low-entropy secret such as a password into a fixed-length cryptographic key, deliberately slowly.

A standard algorithm that turns a password into a cryptographic key by hashing it many thousands of times to slow attackers down.

A unique value mixed into a password before hashing so that identical passwords produce different hashes.

A design where the service provider never holds the key needed to read your data, so it cannot decrypt it even under compulsion.

When an attacker gains control of an account and locks the legitimate owner out of it.

An attack that tries every possible combination until it finds the correct password or key.

Automatically replaying email and password pairs stolen from one breach against many other services.

An incident in which data held by an organisation is accessed or taken by someone not authorised to have it.

An attack that tries words, names, and known passwords with common variations instead of every combination.

Using someone's personal information to impersonate them, usually for financial gain.

Software or hardware that records every keystroke, capturing passwords as they are typed.

Trying one common password against many accounts, rather than many passwords against one account.

Tricking someone into entering credentials on a fake site or handing them over to an impostor.

A precomputed lookup structure that reverses unsalted password hashes almost instantly.

Observing someone enter a password or PIN in person, or through a camera, to steal it.

Persuading a mobile carrier to transfer your phone number to an attacker's SIM, capturing your calls and SMS codes.

Manipulating a person into granting access, rather than defeating a technical control.

An app that generates rotating six-digit codes as a second factor, derived from a shared secret and the current time.

Using a physical characteristic such as a fingerprint or face to unlock a device or approve access.

A cryptographic key pair stored on your device that replaces a password and cannot be phished or reused.

A reminder or personal question used to recover access. Its answer is often easier to guess than the password.

A short numeric code, usually four to six digits, protecting a card, phone, or device behind an attempt limit.

A physical device that proves your identity cryptographically and refuses to work on a fake site.

Using one account to sign in to many services, so credentials are held in one place.

Requiring a second proof of identity beyond the password, such as a time-based code or hardware key.