Glossary

Plain-language definitions of the terms used across this site.

Dictionary attack: A dictionary attack tests words from a predefined list against a hash instead of every possible combination — faster because real passwords are not random.
Key derivation function (KDF): A key derivation function turns a password into a cryptographic key through a deliberately slow, often memory-hard process, making each guess costly to test.
Hash rate: Hash rate is the number of candidate passwords a cracking tool can hash and compare per second — the single number that determines how fast a given hash type falls.
Pepper: A pepper is a secret value added to every password before hashing, kept outside the database so a database leak alone does not expose it like a salt would.
Brute-force attack: A brute-force attack tries every possible password in a keyspace, one by one, until it finds a match — guaranteed to work eventually, but only fast when the keyspace is small.
Keyspace: The keyspace is the total number of candidate passwords a brute-force or mask attack has to try, growing exponentially with character set size and length.
Rainbow table: A rainbow table is a precomputed lookup structure that reverses unsalted hashes back to passwords, trading large storage for near-instant cracking.
Salt: A salt is a unique random value added to a password before hashing, defeating rainbow tables and ensuring identical passwords produce different hashes.
Wordlist: A wordlist is a file of candidate passwords fed to a cracking tool, where each line is tested against a hash — often combined with rules to expand coverage.