| Strongest storage method | Hashing with a unique salt per user (NIST Digital Identity Guidelines (SP 800-63B)) |
| Minimum recommended password length | 15+ characters for general accounts (NIST SP 800-63B, 2017 (updated guidance)) |
| MFA effectiveness | Blocks the vast majority of automated account attacks (Google Security Blog research, cited broadly in industry guidance) |
| Credential stuffing risk factor | Password reuse across multiple services |
| Zero-knowledge benefit | Service provider cannot access your stored passwords |
| Entropy boosts from | Length and true randomness — not just symbol substitution (NIST SP 800-63B composition guidance) |
Why This Glossary Exists
Password security advice is everywhere, but the vocabulary behind it often goes undefined. Terms like hashing, credential stuffing, and entropy appear regularly in breach notifications, security audits, and privacy policy updates — yet most explanations assume readers already know what they mean.
This quick-reference glossary cuts through that assumption. Whether you're reading a data-breach notice or trying to understand why your password manager works the way it does, the definitions below give you the plain-English foundation you need. For a broader look at staying secure online, see the complete password safety guide.
Hashing
A one-way process that converts a password into a fixed-length string of characters called a hash. Because hashing cannot be reversed, reputable services store hashes rather than your actual password — so even if their database is stolen, your raw password isn't directly exposed.
Salting
Adding a unique random string (the 'salt') to a password before hashing it. This ensures that two users with identical passwords produce completely different hashes, blocking attackers from using precomputed lookup tables to crack them.
Encryption
A two-way process that scrambles data so only someone with the correct key can read it. Unlike hashing, encrypted data is designed to be decrypted — making encryption appropriate for stored files and messages, but not for passwords.
Password Entropy
A measure of how unpredictable a password is, expressed in bits. Higher entropy means more possible combinations, which makes brute-force guessing harder. Length and randomness are the two biggest contributors to entropy.
Credential Stuffing
An attack where stolen username-and-password pairs from one breach are automatically tested against other services. It works because many people reuse the same credentials across multiple accounts.
Brute-Force Attack
A method where an attacker systematically tries every possible combination of characters until the correct password is found. Short or simple passwords are especially vulnerable because fewer combinations need to be tested.
Dictionary Attack
A targeted form of password guessing that tests words from a list — including common passwords, phrases, and known substitutions — rather than every possible character combination. It exploits predictable password choices.
Multi-Factor Authentication (MFA)
A login process that requires at least two different types of proof: typically something you know (a password) plus something you have (a phone) or something you are (a fingerprint). MFA greatly limits the damage if a password is compromised.
Password Manager
An application that generates, stores, and autofills strong, unique passwords for each of your accounts. Your passwords are secured inside an encrypted vault accessed with one master password.
Plaintext Storage
Storing passwords in their original, unmodified form with no hashing or encryption. This is a serious security failure — if the database is breached, every user's password is immediately readable by attackers.
Passphrase
A password made up of several random words strung together (for example, 'ocean-lamp-thunder-fork'). Passphrases can have very high entropy while remaining easier to remember than random character strings.
Zero-Knowledge Architecture
A design where a service provider encrypts your data on your device before it reaches their servers, so they never have access to your unencrypted information. Many password managers use this model — the provider literally cannot see your passwords.
Key Concepts at a Glance
The terms above describe processes that happen mostly behind the scenes — in databases, authentication servers, and the software running on your devices. Understanding them helps you evaluate the security claims services make and spot warning signs in breach reports.
| Strongest storage method | Hashing with a unique salt per user (NIST Digital Identity Guidelines (SP 800-63B)) |
| Minimum recommended password length | 15+ characters for general accounts (NIST SP 800-63B, 2017 (updated guidance)) |
| MFA effectiveness | Blocks the vast majority of automated account attacks (Google Security Blog research, cited broadly in industry guidance) |
| Credential stuffing risk factor | Password reuse across multiple services |
| Zero-knowledge benefit | Service provider cannot access your stored passwords |
| Entropy boosts from | Length and true randomness — not just symbol substitution (NIST SP 800-63B composition guidance) |
A few patterns are worth highlighting:
- Hashing and salting work together. A hash alone can be reversed using precomputed tables; a salt prevents that by making each hash unique, even when two users share the same password.
- Encryption is not hashing. Encrypted data can be decrypted with the right key. Hashed data, by design, cannot be reversed — making hashing the appropriate technique for storing passwords.
- Entropy matters more than complexity rules. A long, randomly generated passphrase often has higher entropy than a short password padded with symbols. Length and randomness both contribute.
You can apply these concepts directly: when a service announces a breach, check whether passwords were hashed and salted or stored in plaintext or with weak encryption. That distinction determines how urgently you need to act. For a practical next step, work through the password health checklist to identify accounts that need immediate attention.
Password security also intersects with how your devices and networks are protected. See device security fundamentals and the network security glossary for related terminology.