Password and security terms, explained
Plain-English definitions for the password management, authentication and security terms your team runs into. Search by name or browse by category.
99 terms
- Networking and Infrastructure
Access Control List (ACL)
A list of permissions that defines which users or system processes are granted access to specific objects, directories, or network resources.
Read the definition - Compliance and Privacy
Activity Log
A record of all actions taken within a system, such as logins, password changes, and access events. Activity logs are essential for security audits and compliance monitoring.
Read the definition - Authentication
Adaptive Authentication
A security method that adjusts the level of authentication required based on context (such as device, location, or user behavior) rather than applying a fixed login process every time.
Read the definition - Cybersecurity
AES-256 Encryption
Advanced Encryption Standard with a 256-bit key, the gold standard for symmetric encryption used by password managers to protect stored credentials at rest.
Read the definition - Attacks and Threats
AI Password Cracking
The use of machine learning models to guess or brute-force passwords significantly faster than traditional methods, making strong, unique passwords more important than ever.
Read the definition - Cybersecurity
API Key
A unique identifier used to authenticate requests to an API. API keys must be stored securely, as a leaked key can grant unauthorized access to services and data.
Read the definition - Cybersecurity
Attack Surface
The total number of points where an unauthorized user could try to enter or extract data from a system. Reducing the attack surface is a fundamental security goal.
Read the definition - Password Management
Autofill
A browser or password manager feature that automatically fills in saved usernames and passwords on recognized login pages, speeding up access while reducing typing errors.
Read the definition - Attacks and Threats
Backdoor
A hidden method of bypassing normal authentication in a computer system, often installed by attackers or built into software for maintenance purposes.
Read the definition - Authentication
Biometric Authentication
Using unique physical characteristics (fingerprint, face, iris, or voice) to verify identity, offering a passwordless alternative to traditional credentials.
Read the definition - Attacks and Threats
Botnet
A network of compromised computers ("bots" or "zombies") controlled remotely by an attacker, often used for DDoS attacks, spam distribution, or credential stuffing.
Read the definition - Attacks and Threats
Brute Force Attack
A cyberattack method where an attacker systematically tries every possible combination of characters to guess a password, highlighting the importance of length and complexity.
Read the definition - Compliance and Privacy
BYOD (Bring Your Own Device)
A workplace policy allowing employees to use personal devices for work. BYOD introduces cybersecurity challenges around data separation and credential management.
Read the definition - Authentication
CAPTCHA
A challenge-response test designed to determine whether a user is human, commonly used to prevent automated bots from brute-forcing login forms.
Read the definition - Networking and Infrastructure
Certificate Authority (CA)
An organization that issues digital certificates, verifying the identity of websites and enabling encrypted HTTPS connections.
Read the definition - Cybersecurity
Cloud Security
The set of policies, controls, and technologies used to protect data, applications, and infrastructure hosted in cloud environments from breaches and unauthorized access.
Read the definition - Cybersecurity
Content Security Policy (CSP)
An HTTP security header that helps prevent XSS and data injection attacks by specifying which content sources a browser should trust.
Read the definition - Attacks and Threats
Credential Stuffing
An automated attack that uses stolen username/password pairs from one breach to try to access accounts on other services, exploiting password reuse.
Read the definition - Attacks and Threats
CSRF (Cross-Site Request Forgery)
A web attack that tricks authenticated users into unknowingly submitting malicious requests to a site where they're already logged in.
Read the definition - Compliance and Privacy
Cybersecurity Policy
A documented set of rules and guidelines that defines how an organization protects its digital assets, manages access, handles incidents, and trains employees.
Read the definition - Cybersecurity
Dark Web Monitoring
A service that scans dark web forums and databases for leaked credentials associated with your email addresses, alerting you when your information appears in a breach.
Read the definition - Cybersecurity
Data Breach
An incident in which sensitive, protected, or confidential data is accessed, disclosed, or stolen without authorization, often leading to credential exposure.
Read the definition - Compliance and Privacy
Data Loss Prevention (DLP)
Technologies and policies designed to detect and prevent unauthorized transmission of sensitive data outside an organization's network.
Read the definition - Attacks and Threats
Deepfake (Cybersecurity)
AI-generated synthetic media (such as fake audio or video of a person) used by attackers to impersonate executives or employees and authorize fraudulent actions.
Read the definition - Networking and Infrastructure
Digital Certificate
An electronic document that uses a digital signature to bind a public key with an identity, enabling encrypted communication and identity verification.
Read the definition - Attacks and Threats
DNS Hijacking
An attack where DNS queries are redirected to malicious servers, sending users to fake websites that harvest credentials even when they type the correct URL.
Read the definition - Attacks and Threats
Dumpster Diving
A social engineering technique where attackers search through discarded materials (physical or digital) to find passwords, credentials, or sensitive information.
Read the definition - Cybersecurity
End-to-End Encryption (E2EE)
A system where data is encrypted on the sender's device and can only be decrypted by the intended recipient: no intermediary, including the service provider, can read it.
Read the definition - Cybersecurity
Endpoint Security
Security measures focused on protecting individual devices (laptops, phones, tablets) that connect to a network, often including antivirus, encryption, and device management.
Read the definition - Attacks and Threats
Extortion Email
A scam email claiming the attacker has compromising information or access to your device, demanding payment to prevent exposure. Usually relies on fear and leaked password lists.
Read the definition - Authentication
FIDO2
An open authentication standard that enables passwordless login using hardware security keys or platform authenticators like fingerprint sensors and facial recognition.
Read the definition - Networking and Infrastructure
Firewall
A network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules, forming a barrier between trusted and untrusted networks.
Read the definition - Compliance and Privacy
Governance, Risk, and Compliance (GRC)
A framework for managing an organization's governance, enterprise risk management, and regulatory compliance in a unified approach.
Read the definition - Cybersecurity
Hash Function
A mathematical algorithm that converts data into a fixed-length string of characters. Secure hash functions are used to store passwords without keeping the plaintext.
Read the definition - Cybersecurity
Have I Been Pwned (HIBP)
A free online service that lets you check whether your email address or password has appeared in a known public data breach database.
Read the definition - Cybersecurity
Honey Pot
A decoy system designed to attract and detect attackers, providing early warning of intrusion attempts while diverting attention from real assets.
Read the definition - Authentication
HOTP (HMAC-based One-Time Password)
A one-time password algorithm based on a counter value rather than time, generating a new code each time the counter increments. A precursor to TOTP.
Read the definition - Authentication
IDaaS (Identity as a Service)
Cloud-delivered identity and access management, providing authentication, SSO, and directory services without requiring on-premises infrastructure.
Read the definition - Compliance and Privacy
Incident Response Plan
A documented procedure that outlines how an organization detects, responds to, and recovers from cybersecurity incidents like data breaches or ransomware attacks.
Read the definition - Cybersecurity
Insider Threat
A security risk that originates from within an organization (such as a current or former employee, contractor, or partner) who misuses authorized access.
Read the definition - Networking and Infrastructure
Intrusion Detection System (IDS)
A system that monitors network traffic or system activity for suspicious behavior and policy violations, alerting administrators to potential security incidents.
Read the definition - Networking and Infrastructure
IP Whitelisting
A security practice that allows access to a system only from pre-approved IP addresses, blocking all other connection attempts.
Read the definition - Authentication
Kerberos
A network authentication protocol that uses tickets and symmetric cryptography to allow secure authentication over insecure networks without transmitting passwords.
Read the definition - Attacks and Threats
Keylogger
Malicious software that records keystrokes on a device to capture passwords and other sensitive information without the user's knowledge.
Read the definition - Cybersecurity
Least Privilege
A security principle that grants users only the minimum level of access needed to perform their job functions, limiting potential damage from compromised accounts.
Read the definition - Authentication
Magic Link
A passwordless authentication method where a one-time login link is sent to a user's email address, allowing them to sign in without a password.
Read the definition - Attacks and Threats
Malware
Malicious software designed to damage, disrupt, or gain unauthorized access to computer systems, including viruses, trojans, ransomware, spyware, and worms.
Read the definition - Attacks and Threats
Man-in-the-Middle Attack (MitM)
A cyberattack where an adversary secretly intercepts and potentially alters communication between two parties who believe they are communicating directly.
Read the definition - Password Management
Master Password
The single password used to unlock a password manager vault. It is never sent to servers and is the only credential a user must remember.
Read the definition - Authentication
MFA (Multi-Factor Authentication)
A security mechanism requiring two or more independent verification factors (something you know, have, or are) before granting access to an account.
Read the definition - Networking and Infrastructure
Network Segmentation
Dividing a network into smaller, isolated segments to limit lateral movement by attackers and contain breaches to a single segment.
Read the definition - Authentication
OAuth 2.0
An open authorization framework that allows third-party applications to access user data on another service without exposing the user's password.
Read the definition - Password Management
Offboarding Security
The process of securely removing a departing employee's access to company systems, credentials, and data to prevent unauthorized use after they leave.
Read the definition - Compliance and Privacy
Onboarding Security
The security practices involved in setting up a new employee's access: provisioning accounts, assigning roles, and ensuring credentials follow least-privilege principles.
Read the definition - Authentication
One-Time Password (OTP)
A password that is valid for only a single session or transaction, generated automatically and typically delivered via SMS, email, or an authenticator app.
Read the definition - Password Management
One-Time Secret
A secure method of sharing sensitive information (like a password) via a link that self-destructs after being viewed once, preventing repeated access.
Read the definition - Authentication
Passkey
A FIDO2-based passwordless authentication credential stored on a device, using biometrics or a PIN to authenticate instead of a traditional password.
Read the definition - Password Management
Passphrase
A sequence of random words used as a password. Passphrases are typically longer and easier to remember than complex passwords while still being highly secure.
Read the definition - Password Management
Password Audit
A systematic review of an organization's passwords to identify weak, reused, or compromised credentials, typically performed using a password manager's reporting tools.
Read the definition - Cybersecurity
Password Encryption
The process of converting plaintext passwords into an unreadable format using cryptographic algorithms, ensuring stored credentials cannot be directly read if stolen.
Read the definition - Password Management
Password Generator
A tool that creates random, high-entropy passwords meeting specified length and character requirements, eliminating the human tendency to choose predictable passwords.
Read the definition - Password Management
Password Manager
Software that securely stores, generates, and autofills passwords for websites and apps, encrypting the vault with a master password so users only need to remember one.
Read the definition - Compliance and Privacy
Password Policy
A set of rules governing how passwords are created, managed, and rotated within an organization to ensure a baseline level of credential security.
Read the definition - Attacks and Threats
Password Spraying
A type of brute force attack where a small set of commonly used passwords are tried across many accounts to avoid triggering account lockout thresholds.
Read the definition - Password Management
Password Vault
An encrypted container within a password manager where credentials are stored. Enterprise vaults often support shared access with role-based permissions.
Read the definition - Cybersecurity
Penetration Testing
An authorized simulated cyberattack performed to evaluate the security of a system, identifying vulnerabilities before real attackers exploit them.
Read the definition - Attacks and Threats
Phishing
A social engineering attack where attackers pose as legitimate entities (via email, SMS, or fake websites) to trick users into revealing credentials or installing malware.
Read the definition - Networking and Infrastructure
PKI (Public Key Infrastructure)
A framework of hardware, software, policies, and standards used to create, manage, distribute, and revoke digital certificates for secure communication.
Read the definition - Attacks and Threats
Pretexting
A social engineering technique where an attacker fabricates a believable scenario or identity to manipulate a victim into revealing information or granting access.
Read the definition - Compliance and Privacy
Principle of Least Privilege (PoLP)
A security concept where users and systems are given only the minimum access rights needed to perform their job, reducing the attack surface for breaches.
Read the definition - Attacks and Threats
Privilege Escalation
An attack technique where an adversary gains higher-level permissions than initially granted, moving from a standard user account to administrator or root access.
Read the definition - Attacks and Threats
Quishing (QR Code Phishing)
A phishing variant where attackers embed malicious URLs in QR codes, bypassing traditional email link-scanning security tools.
Read the definition - Attacks and Threats
Rainbow Table
A precomputed table of hash values used to reverse cryptographic hash functions, enabling rapid password cracking against unsalted hashes.
Read the definition - Attacks and Threats
Ransomware
Malicious software that encrypts a victim's files or systems and demands payment for the decryption key. Password hygiene and backups are key defenses.
Read the definition - Compliance and Privacy
RBAC (Role-Based Access Control)
A method of restricting system access based on users' roles within an organization, ensuring people can only access data relevant to their responsibilities.
Read the definition - Attacks and Threats
Replay Attack
A network attack where a valid data transmission is maliciously repeated or delayed. One-time passwords and session tokens are common defenses.
Read the definition - Compliance and Privacy
Security Audit
A formal evaluation of an organization's information systems, policies, and practices to identify vulnerabilities, ensure compliance, and recommend improvements.
Read the definition - Cybersecurity
Security Posture
The overall cybersecurity strength and readiness of an organization (encompassing policies, tools, processes, and employee awareness) to defend against threats.
Read the definition - Attacks and Threats
Session Hijacking
An attack where an attacker steals or predicts a valid session token to impersonate an authenticated user without knowing their password.
Read the definition - Attacks and Threats
SIM Swapping
A fraud attack where an attacker convinces a carrier to transfer a victim's phone number to a SIM they control, intercepting SMS-based two-factor authentication codes.
Read the definition - Attacks and Threats
Smishing
SMS phishing, a social engineering attack delivered via text message, often containing a malicious link or urgent request designed to steal credentials.
Read the definition - Compliance and Privacy
SOC 2 Compliance
A security framework for service organizations developed by the AICPA, requiring controls around security, availability, confidentiality, and privacy of customer data.
Read the definition - Attacks and Threats
Social Engineering
Psychological manipulation techniques used to trick people into divulging confidential information or performing actions that compromise security.
Read the definition - Attacks and Threats
Spear Phishing
A targeted phishing attack tailored to a specific individual or organization using personal details, making it far more convincing than generic phishing emails.
Read the definition - Authentication
SSO (Single Sign-On)
An authentication scheme that allows users to log in once with a single set of credentials and gain access to multiple related systems without re-authenticating.
Read the definition - Cybersecurity
Third-Party Data Breach
A breach that occurs at a vendor, supplier, or partner organization and exposes data belonging to their customers or clients, often beyond the victim's direct control.
Read the definition - Cybersecurity
Threat Modeling
A structured approach to identifying, quantifying, and addressing security risks by analyzing potential threats, attack vectors, and the assets that need protection.
Read the definition - Authentication
TOTP (Time-Based One-Time Password)
A temporary code generated by an authenticator app (e.g. Google Authenticator) that changes every 30 seconds, used as a second factor in 2FA.
Read the definition - Authentication
Two-Factor Authentication (2FA)
An extra security layer requiring a second form of verification (such as a TOTP code or push notification) in addition to a password when logging in.
Read the definition - Attacks and Threats
Typosquatting
Registering domain names that are common misspellings of popular websites to capture credentials from users who mistype URLs.
Read the definition - Attacks and Threats
Vishing
Voice phishing, a social engineering attack conducted over the phone where an attacker impersonates a trusted organization to extract sensitive information.
Read the definition - Cybersecurity
VPN (Virtual Private Network)
A technology that encrypts internet traffic and masks IP addresses by routing connections through a secure server, protecting data on public networks.
Read the definition - Cybersecurity
Vulnerability
A weakness in a system, application, or process that can be exploited by an attacker to gain unauthorized access or cause harm.
Read the definition - Attacks and Threats
Watering Hole Attack
An attack where hackers compromise a website frequently visited by a target group, infecting visitors with malware or redirecting them to credential-harvesting pages.
Read the definition - Authentication
WebAuthn
A W3C standard that enables passwordless authentication in web browsers using public-key cryptography, forming the basis of passkeys and FIDO2.
Read the definition - Attacks and Threats
XSS (Cross-Site Scripting)
A web vulnerability where attackers inject malicious scripts into trusted websites, which then execute in other users' browsers to steal session tokens or credentials.
Read the definition - Cybersecurity
Zero Trust
A security framework that requires strict identity verification for every person and device attempting to access resources, regardless of whether they are inside or outside the network.
Read the definition - Cybersecurity
Zero-Day Exploit
An attack that exploits a previously unknown software vulnerability before the vendor has released a patch, leaving systems temporarily defenseless.
Read the definition - Cybersecurity
Zero-Knowledge Architecture
A security model where a service provider holds encrypted data but possesses no key to decrypt it: only the user can read their own data, including the password manager.
Read the definition
Stop sharing passwords in spreadsheets
TeamPassword stores, shares and rotates your team credentials, encrypted end to end.
Trusted by 900+ agencies and small teams worldwide