20 essential terms
Security glossary
Clear definitions for authentication, passwords, encryption, recovery, phishing, and VPN terminology.
Two-factor authentication (2FA)
A sign-in method that asks for two different proofs of identity, commonly a password and something you possess, such as a rotating code, passkey, or security key.
Learn more →02Multi-factor authentication (MFA)
Authentication that requires two or more independent factors: something you know, possess, or are. Two-factor authentication is a specific form of MFA.
Learn more →03TOTP
A time-based one-time password generated from a shared secret and the current time. Most authenticator apps refresh a six-digit TOTP code every 30 seconds.
Learn more →04HOTP
A one-time password generated from a shared secret and a counter. Unlike TOTP, it changes when a new code is requested rather than when time advances.
Learn more →05One-time password (OTP)
A code intended for a single sign-in or transaction. OTPs may arrive by SMS or email, or be generated locally by an authenticator.
Learn more →06Passkey
A phishing-resistant sign-in credential based on public-key cryptography. The private key remains on the user's device or trusted credential provider.
Learn more →07Security key
A physical device that proves possession during sign-in, usually through USB, NFC, or Bluetooth and standards such as FIDO2 or WebAuthn.
Learn more →08Recovery code
A single-use backup code supplied by a service so you can regain access when your normal second factor is unavailable.
Learn more →09Password manager
Software that creates and stores unique credentials in an encrypted vault, reducing password reuse and the need to remember every login.
Learn more →10Password generator
A tool that produces long, random, unique passwords. Generated passwords are strongest when saved directly in a trusted password manager.
Learn more →11Master password
The main secret used to unlock a password vault. It should be long, unique, memorable, and never reused on another service.
Learn more →12Encryption
A process that transforms readable data into ciphertext so that only someone with the correct key can read it.
Learn more →13End-to-end encryption
Encryption where data is protected before leaving the user's device and can only be decrypted by intended endpoints, not by intermediate service providers.
Learn more →14Biometric authentication
Identity verification using a physical characteristic such as a face or fingerprint. On Apple devices, apps receive an authentication result rather than raw biometric data.
Learn more →15Phishing
An attempt to trick a person into revealing credentials or approving access through a message, call, or website that impersonates a trusted party.
Learn more →16SIM swapping
An attack in which a criminal transfers a victim's phone number to another SIM or eSIM to intercept calls and SMS verification codes.
Learn more →17Virtual private network (VPN)
A service that creates an encrypted tunnel between a device and a VPN endpoint, reducing exposure on local networks and changing the visible network exit point.
Learn more →18VPN kill switch
A VPN feature that blocks network traffic if the protected tunnel disconnects, helping prevent accidental exposure through the normal connection.
Learn more →19DNS leak
A situation where domain-name lookups bypass the VPN's intended DNS path, potentially revealing browsing destinations to another network provider.
Learn more →20Zero-knowledge design
A system design intended to prevent a service provider from learning protected user secrets. The claim should be supported by a clear cryptographic architecture, not marketing language alone.
Learn more →