Developer Security Glossary
56 plain-language terms · Last updated: August 23, 2026
This glossary collects the vocabulary you meet across BetterPass's tools — passwords, hashing, encoding, tokens, and serialization — explained without jargon piling on jargon.
Every entry stands on its own, and terms tied to a specific tool link straight to it so you can see each concept working in practice.
Passwords
Core concepts behind creating strong credentials and defending them against attacks.
Passphrase
A password made of several random words strung together, such as "harbor-lantern-quartz-nine". Because each added word multiplies the search space, passphrases can be long and memorable at the same time. Length and randomness matter more than exotic symbols.
Entropy
A measure, expressed in bits, of how unpredictable a secret is. Each additional bit doubles the work an attacker must do to guess correctly. A random 128-bit value is considered effectively unguessable, while short human-chosen passwords often carry surprisingly little real entropy. Try the Entropy Calculator.
Brute-Force Attack
An attack that systematically tries every possible combination until it finds the right one. Feasibility depends almost entirely on length and randomness: cost grows exponentially with each added character, which is why long passwords remain practical defenses.
Dictionary Attack
A guessing attack that starts with lists of real words, common passwords, and known leak patterns instead of all combinations. Predictable substitutions such as replacing letters with look-alike symbols fall to these lists quickly.
Credential Stuffing
Replaying username-and-password pairs stolen from one breach against many other sites, betting that people reused them. Because it exploits reuse rather than weak passwords, unique passwords per site are the reliable defense.
Breach Database
A public collection of credentials exposed in data breaches, used to check whether your own secrets are already compromised. Well-designed checkers never send your actual password anywhere — they share only a small fragment of its hash. Try the Breach Checker.
K-Anonymity
A privacy model where you reveal only enough information to match a group of at least k records, so your exact item stays hidden. The breach checker applies it by sending just the first five characters of a SHA-1 hash to the Have I Been Pwned service; matching happens locally afterward.
Password Manager
An application that generates and stores strong, unique passwords in an encrypted vault unlocked by one master passphrase. It removes the memory burden that pushes people toward reuse, which is the root of most credential problems.
Composition Rules
Legacy requirements mandating specific character mixes, such as upper case plus digits plus symbols. Modern guidance has dropped them because forced substitutions push users toward predictable patterns like capitalizing the first letter or appending a digit.
NIST SP 800-63B
The current United States standard for digital identity guidelines, widely treated as best practice worldwide. It recommends minimum lengths, screening against breach lists, allowing all characters including spaces, and dropping forced composition rules and periodic rotation unless compromise is detected. Try the Password Policy Tool.
Password Policy
The set of rules a system enforces before accepting a credential, covering length limits, blocked patterns, and breach screening. A good policy maximizes attacker cost while staying usable for real people. Try the Password Policy Tool.
Hashing & Key Derivation
One-way functions that fingerprint data and turn passwords into storage-safe keys.
Cryptographic Hash Function
A one-way function that maps input of any size to a fixed-size fingerprint. Changing even one bit of input changes the output completely, and reversing the process is computationally infeasible. Hashing is not encryption — there is no key and no way back.
Digest
The output produced by a hash function, conventionally written as hexadecimal text. A SHA-256 digest is always exactly 256 bits, whether you hash a single word or an entire disk image. Try the SHA-256 Tool.
Collision
The event where two different inputs produce the same digest. Collisions are mathematically unavoidable but should be practically unfindable; when researchers can manufacture them cheaply, as happened for MD5 and SHA-1, the hash is considered broken for security use.
Checksum
A fast, non-cryptographic value used to detect accidental corruption during transfer or storage. Checksums catch bit flips but not deliberate tampering, since attackers can recompute them trivially. Use cryptographic hashes when malice is possible. Try the Hash Generator.
Rainbow Table
A precomputed table mapping likely inputs straight to their hashes, trading huge storage for instant lookups. Salting defeats rainbow tables outright because the same password hashes differently on every account and every system.
Salt
Unique random data combined with each password before hashing. Salts guarantee identical passwords produce different stored hashes and make precomputation useless. They do not need to be secret — they are stored alongside the hash by design.
Pepper
A secret constant applied to every password before hashing, stored outside the database — for example in environment configuration. If attackers steal the database alone, the pepper keeps every hash simultaneously unusable until they also obtain the secret.
Key Derivation Function (KDF)
A deliberately slow hash designed for passwords and key generation. Where normal hashes finish in microseconds, KDFs take tens or hundreds of milliseconds, so offline brute-force attacks become billions of times more expensive. Argon2, bcrypt, scrypt, and PBKDF2 are the standards.
Argon2
Winner of the Password Hashing Competition and today's recommended choice. Its tunable memory requirement makes GPUs and ASICs inefficient, with Argon2id the balanced variant most new systems adopt. Try the Argon2 Tool.
bcrypt
A battle-tested KDF from 1999 with a built-in cost factor that scales over time. Its notable quirk is a 72-byte input limit, meaning very long passphrases get truncated before processing. Try the bcrypt Tool.
scrypt
A memory-hard KDF that requires large amounts of RAM while hashing, driving up the hardware cost of massively parallel cracking rigs. Popular in cryptocurrencies and file encryption. Try the scrypt Tool.
PBKDF2
The oldest standardized KDF, based on repeated HMAC iterations. Being CPU-only it needs very high iteration counts today, but it remains required in FIPS-validated environments and is universally available. Try the PBKDF2 Tool.
HMAC
Hash-based Message Authentication Code — a keyed construction proving both integrity and authenticity of a message. Only holders of the shared secret key can produce or verify the tag, distinguishing it from plain hashing. Try the HMAC Generator.
Encoding
Reversible representations that move binary data through text-friendly channels.
Binary-to-Text Encoding
Any scheme that maps arbitrary bytes onto a safe alphabet of printable characters, letting binary payloads travel through email, JSON, URLs, or source code. Encoding is fully reversible and provides no confidentiality whatsoever.
Encoding vs Encryption vs Hashing
Encoding transforms representation and anyone can reverse it; encryption transforms data using a secret key and only keyholders can reverse it; hashing produces a one-way fingerprint that cannot be reversed at all. Confusing these three is the single most common crypto terminology mistake.
Base64
The dominant binary-to-text scheme, mapping every three bytes to four characters drawn from letters, digits, plus, and slash. Output grows by roughly a third and typically ends in one or two equals signs of padding. Try the Base64 Tool.
Base32
A variant using an upper-case alphabet of thirty-two letters and digits, chosen to survive case-insensitive systems, transcription by hand, and human dictation. It is less compact than Base64 but far friendlier for spoken or printed secrets. Try the Base32 Tool.
Base58
A Bitcoin-inspired alphabet that removes visually ambiguous characters — zero, capital O, capital I, and lower-case l — along with punctuation. Commonly seen in cryptocurrency addresses and keys where manual copying happens. Try the Base58 Tool.
Ascii85
A denser scheme packing four bytes into five characters, adding about twenty-five percent overhead versus Base64's thirty-three. Found inside PDF files, PostScript, and git binary patches. Try the Ascii85 Tool.
Hexadecimal
Base-sixteen notation using digits zero through nine and letters A through F. Every byte becomes exactly two hex characters, making it the universal format for displaying hashes, keys, and raw memory. Try the Hex Tool.
Percent Encoding
Also called URL encoding: bytes unsafe in a URL are replaced with a percent sign followed by their two-digit hexadecimal value. Spaces become %20, for example, letting reserved characters travel safely inside links. Try the URL Encoder.
UTF-8
The web's standard character encoding, representing ASCII in one byte and other Unicode characters in up to four. Its backward compatibility with ASCII is why encoded payloads and code coexist cleanly in the same file.
Padding
The trailing equals signs that pad Base64 and Base32 output so its length fits the encoding block size. Padding carries no information of its own and some URL-safe variants omit it entirely.
Tokens & Identity
Signed and structured credentials that carry identity across systems.
JSON Web Token (JWT)
A compact, URL-safe credential composed of three Base64url parts — header, payload, and signature — joined by dots. Claims ride inside the payload, protected by the signature rather than hidden, so sensitive data must never be placed there. Try the JWT Decoder.
Claim
A statement asserted inside a token payload, such as who issued it, whom it identifies, or when it expires. Signatures prove claims were not altered after issuance; they do not conceal them.
Base64url
JWT's URL-safe flavor of Base64: plus and slash become hyphen and underscore, and padding is dropped. Same decoding rules otherwise, purpose-built to survive inside URLs and cookies unchanged.
Signature Verification
Checking a token's signature with the issuer's key before trusting any claim inside it. Classic pitfalls include accepting unsigned tokens, trusting an attacker-nominated algorithm, and treating verification as optional. Try the Token Playground.
JWS / JWE
Two companion standards: JWS signs content, producing verifiable tokens like ordinary JWTs, while JWE encrypts content so only intended recipients can read the payload. They can be combined when claims need both secrecy and authenticity.
OAuth 2.0
The authorization framework letting an application obtain limited access to a user's resources without ever seeing their password. Strictly speaking it authorizes rather than authenticates — answering what apps may do, not who the user is.
OpenID Connect (OIDC)
An identity layer built on OAuth 2.0 that adds authentication. The ID token it issues is itself a signed JWT whose claims tell the application who logged in and when. Try the OIDC Debugger.
Access Token vs Refresh Token
Access tokens authorize immediate API calls and live briefly; refresh tokens are longer-lived credentials used solely to obtain fresh access tokens. Keeping access windows short limits damage if one leaks.
Opaque Token
A random string carrying no inspectable structure — the server must look it up to learn anything. All intelligence lives server-side, which makes revocation simple at the cost of a lookup per request. Try the Opaque Token Generator.
PASETO
Platform-Agnostic Security Tokens — a JWT alternative that locks algorithms to vetted choices per version, eliminating entire classes of misconfiguration. Payloads may be signed or encrypted depending on the chosen variant. Try the PASETO Tool.
SAML
The Security Assertion Markup Language — an XML-based standard still dominant in enterprise single sign-on. An identity provider signs assertions that services verify, exchanging XML documents rather than compact tokens. Try the SAML Tools.
Token Expiration
The expiry claim bounding a token's usable lifetime, checked by every verifier. Short-lived access paired with refresh rotation means a leaked token stops working quickly instead of forever.
Serialization
Formats that package structured data for storage and transmission.
Serialization
Converting in-memory data structures into a byte or text stream suitable for storage or transmission; deserialization rebuilds the original structures from that stream. Choosing a format shapes size, speed, safety, and cross-language compatibility.
JSON
JavaScript Object Notation — the ubiquitous human-readable interchange format built on objects, arrays, strings, numbers, booleans, and null. Its universality makes it the default choice for APIs and configuration despite being verbose compared with binary formats. Try the JSON Formatter.
MessagePack
A binary serialization that encodes JSON-like structures far more compactly by using typed, variable-length prefixes. Drop-in semantics with JSON but smaller payloads and faster parsing. Try the MessagePack Tool.
CBOR
Concise Binary Object Representation, standardized as RFC 8949. Self-describing like JSON yet binary and compact, which suits constrained devices — it is the format underneath WebAuthn and COSE signatures. Try the CBOR Tool.
BSON
Binary JSON, the storage and wire format of MongoDB. It extends JSON with extra types such as dates, object identifiers, and raw binary while remaining traversable without full parsing. Try the BSON Converter.
Protocol Buffers
Google's schema-driven binary format. You declare messages and field numbers in a .proto file, generate language bindings, and get compact, versioned encodings that evolve without breaking older readers. Try the Protobuf Decoder.
Schema
A formal contract describing fields, types, and constraints of serialized data. Explicit schemas enable validation, efficient binary layouts, and safe evolution; formats without them rely on conventions and runtime checks.
Self-Describing Format
A format that embeds field names or type tags within the payload itself — JSON and CBOR work this way. Contrast with schema-first formats like Protocol Buffers, where the wire bytes carry only values and tags, keeping them smaller.
Wire Format
The exact byte-level layout data takes on the network or disk. Compatibility rules — which fields map where as versions change — live here, which is why Protobuf assigns permanent field numbers.
Deserialization Safety
Feeding untrusted data into deserializers has powered severe exploits, especially in formats that reconstruct executable objects. Safe practice treats deserialized input as unvalidated external data and prefers plain-data formats.
Every concept above runs hands-on inside BetterPass's browser-side tools — pick a category from the navigation and try the ideas yourself, with no data ever leaving your device.