When an attacker gains control of someone else's online account, often by using stolen or guessed credentials.
Authenticator app
An app that generates short-lived one-time codes, used as a second factor when signing in.
B
Blocklist
A list of known weak or compromised passwords that a service refuses to accept when you create or change a password.
Brute-force attack
An attack that tries every possible combination until the right one is found. The time required grows exponentially with each added character. See the crack-time table.
C
Character set (pool)
The set of symbols a password can be built from, for example 26 lowercase letters, or the 94 printable ASCII characters. A larger pool raises the number of possible passwords.
Credential stuffing
An automated attack that takes username and password pairs leaked from one service and tries them on other services, relying on people reusing passwords.
CSPRNG
A cryptographically secure pseudorandom number generator: a random number generator whose output cannot be practically predicted, even by someone who has seen earlier output. In browsers this is available as crypto.getRandomValues().
D
Data breach
An incident in which private information, such as passwords or personal details, is exposed to people who should not have it. See the data breach checklist.
Diceware
A method of making a passphrase by rolling dice to choose words from a numbered list. The EFF's long list uses five dice per word and has 7,776 words.
Dictionary attack
An attack that guesses from lists of words, common passwords and their usual variations before trying other combinations.
E
Entropy
A measure of unpredictability expressed in bits. For a truly random password, it equals the length multiplied by the base-2 logarithm of the character-set size. Use our Entropy Calculator.
F
Fast and slow hash functions
Fast hash functions such as MD5 can be guessed at billions of attempts per second on modern hardware. Slow, purpose-built functions such as bcrypt and Argon2 are deliberately expensive, which limits how fast stolen hashes can be attacked.
FIDO2 and WebAuthn
Open standards behind passkeys and security keys. WebAuthn is the web API that lets a site ask your device to sign in with a cryptographic key instead of a password. See passkeys explained.
H
Hash
A fixed-length fingerprint produced from data by a hash function. Well-run services store a hash of your password instead of the password itself.
K
Keylogger
Software or hardware that secretly records what you type, including passwords.
M
Master password
The single password that protects a password manager's vault. It should be long, unique and never reused.
Modulo bias
A small unevenness that appears when a random number is squeezed into a range that does not divide evenly, making some outcomes slightly more likely. See rejection sampling.
Multi-factor authentication (MFA, 2FA)
Requiring two or more kinds of proof to sign in, such as something you know (a password), something you have (a phone or security key) and something you are (a fingerprint).
O
Offline attack
Guessing against a stolen copy of password hashes on the attacker's own hardware. There is no login page, so rate limits and lockouts do not apply.
One-time password (OTP)
A code that is valid for a single sign-in or a short time, often sent by SMS or generated by an authenticator app.
Online attack
Guessing passwords through the live login of a service, where rate limiting and account lockouts slow the attacker down.
P
Passkey
A sign-in credential based on public-key cryptography that is unlocked with your device's biometrics, PIN or pattern. See passkeys explained.
Passphrase
A password made of several random words. Length gives it strength and words make it easier to remember. See passphrase vs password.
Password manager
An app that stores your passwords in an encrypted vault and fills them in for you, so you can use a long unique password for every account.
Password spraying
Trying a small number of very common passwords against many accounts, so that no single account sees enough failed attempts to be locked.
Phishing
Fake messages or websites designed to trick you into revealing a password or other sensitive information.
Plaintext
Readable, unencrypted data. A service that stores passwords in plaintext exposes every user if it is breached.
R
Rainbow table
A precomputed table that maps hashes back to likely passwords. Adding a salt to each password defeats it.
Rate limiting
Restricting how many login attempts can be made in a given time, which slows online guessing.
Rejection sampling
A technique for choosing an unbiased random value from a range by discarding random values that fall outside it, which avoids modulo bias.
S
Salt
A random value added to each password before hashing, so identical passwords produce different hashes and precomputed tables become useless.
Search space
The total number of possibilities an attacker would have to consider. For a random password it is the pool size raised to the power of the length.
Security key
A physical device, usually connected by USB or NFC, that proves your identity using FIDO standards. It resists phishing.
SIM swapping
Tricking a mobile carrier into moving a victim's phone number to the attacker's SIM card, in order to intercept SMS codes.
Social engineering
Manipulating people, rather than breaking technology, to reveal information or perform actions.
Entropy is a measure of how unpredictable a password is, expressed in bits. For a truly random password it equals the length multiplied by the base-2 logarithm of the number of possible characters.
Encryption is reversible with a key. Hashing is a one-way process that turns data into a fixed-length fingerprint. Services should store a salted hash of your password, not the password itself.
An automated attack that tries username and password pairs leaked from one site on many other sites. It works because many people reuse passwords, and unique passwords defeat it.
Two-factor authentication (2FA) uses exactly two kinds of proof. Multi-factor authentication (MFA) means two or more. In everyday use the terms are often interchangeable.
A passkey is a sign-in credential based on public-key cryptography, unlocked with your fingerprint, face, PIN or pattern. It replaces a typed password on services that support it.