Home / Password Security Glossary

Password Security Glossary

Plain-language definitions of the terms behind passwords, hashing and account security.

Attacks

Brute force: Trying every possible value until one works. Its only limits are the guessing rate and the number of possibilities, which is why length beats complexity.
Dictionary attack: Brute force narrowed to likely candidates — real words, names, leaked passwords, keyboard patterns. Very effective against passwords people invent themselves.
Credential stuffing: Automatically trying a username and password leaked from one site on many others. It works only because passwords get reused.
Phishing: Tricking you into typing your password into a fake page or message. Password strength is irrelevant here; 2FA and caution are what help.
Keylogger: Malware or hardware that records everything you type, capturing passwords as you enter them regardless of how strong they are.

Entropy: How unpredictable a secret is, measured in bits — roughly the number of guesses needed on average, as a power of two. Each extra bit doubles the work to break it.
Hash: A one-way function that turns any input into a fixed-length fingerprint. Sites store the hash of your password, not the password itself.
Salt (salting): A unique random value mixed into each password before hashing. It makes identical passwords hash differently and defeats precomputed (rainbow) tables.
Key stretching: Deliberately slow hashing (bcrypt, scrypt, Argon2, PBKDF2) that adds a heavy cost to every guess, slowing offline cracking by orders of magnitude.
CSPRNG: A cryptographically secure random generator, like the browser's crypto.getRandomValues(). Its output cannot be predicted or reproduced, unlike Math.random().

Two-factor authentication (2FA): A second proof of identity beyond the password — an app code, a prompt, or a hardware key. It blocks an attacker who has only the password.
Passkey (FIDO2): A passwordless credential bound to your device with public-key cryptography. Nothing secret is sent to the site, so it cannot be phished or leaked in a breach.
Master password: The single password that unlocks a password manager. It is the only one you memorise, so make it a long passphrase and never reuse it.

Passphrase: A password built from several random words. Easy to type and recall, and strong when the words are picked by software rather than by you.
Password manager: An app that creates, stores and fills a unique password for every account behind one master password — the single most effective habit for account security.
Data breach: An incident where a service's user data, often including password hashes, is stolen and usually leaked. Check your exposure with the leak checker on this site.