Glossary
Password and data breach glossary
Summary. What each term means, in a few plain words, and how an official body or the standard behind it defines it. We add terms as our guides use them.
Brute-force attack · Credential stuffing · Data breach · Data broker · Dictionary attack · Entropy (bits) · Hash · k-anonymity (breach check) · Multi-factor authentication · Passkey · Passphrase · Password manager · Password spraying · Salt
Brute-force attack
Guessing a password by trying a very large number of possible passwords, often by machine. A long, random password makes it take far longer.
"Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes"
How to create a strong password
Credential stuffing
Trying email and password pairs leaked from one site on many other sites. It works when people use the same password in more than one place.
"Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through"
Stop one leak reaching everything
Data breach
When personal information held by an organisation is seen, taken or lost without permission. A breach can include email addresses, passwords or other details.
"A data breach happens when personal information is accessed, disclosed without authorisation, or is lost."
Recent data breaches My password is in a breach
Data broker
A company that collects personal details about people from many sources and sells or shares them. The legal definition differs by country and state.
"a business that collects personal information about consumers from various sources"
Remove your personal information
Dictionary attack
Guessing a password by trying words and common passwords from a list first. It is why a single real word, or a word with a number on the end, is weak.
"An attacker tries each of the words in a dictionary as passwords to gain access to the system via some user's account."
Entropy (bits)
A measure of how hard a secret is to guess. Each extra bit doubles the number of guesses an attacker may need. Our generator shows it for each passphrase it makes.
"The amount of uncertainty that an attacker faces to determine the value of a secret."
Hash
A fixed-length fingerprint worked out from data. The same password always gives the same hash, but you cannot run a good hash backwards to get the password.
"A function on bit strings in which the length of the output is fixed."
k-anonymity (breach check)
A way to check a password against a breach list without sending it. Only the first 5 characters of its hash leave the page, and many passwords share them.
"Pwned Passwords also implements a k-anonymity model"
Multi-factor authentication
A login that needs a second proof as well as your password, such as a code from an app or a security key. A leaked password alone is then not enough.
"Authentication using two or more different factors to achieve authentication."
Passkey
A login that uses a key stored on your phone or computer in place of a password. You unlock it with your fingerprint, face or device PIN.
"A passkey is an authentication credential based on FIDO standards"
Password managers and passkeys
Passphrase
A password made of several words. Picked at random, words make a long secret that is easier to remember and type than random characters.
"A passphrase is a memorized secret consisting of a sequence of words or other text"
What is a passphrase? Make a passphrase
Password manager
An app that creates, stores and fills a different password for each site, behind one main password or passkey.
"A password manager stores passwords safely for you"
Password spraying
Trying a few very common passwords against many accounts, rather than many passwords against one account, so that no single account locks.
"Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials."
Salt
A random value a site adds to each password before it stores the hash, so two people with the same password get different hashes.
"A non-secret value used in a cryptographic process, usually to ensure that the results of computations"