Glossary

Privacy and security terms

Short definitions without the extra theory — so you understand what articles and service settings are talking about.

Browser fingerprinting: A way to recognize you without cookies, by the combination of your settings — fonts, screen, language, device model. Together they form an almost unique "signature".
Brute force: An attack where a program guesses a password by trying a huge number of variants. Short, simple passwords fall in seconds; long random ones practically never.
Cookie: A small file a site saves in your browser to recognize you: to keep you signed in, remember settings, and also for advertising tracking across sites.
Credential stuffing: An attack that automatically tries logins and passwords stolen from one site on other sites. It works if you reuse the same password in several places.
Data breach: When a site's user data ends up in the wrong hands because of a hack or a mistake. Breaches most often expose emails, passwords, phone numbers and names.
DKIM: A digital signature on an email. The recipient checks it with a public key from DNS and confirms the email was sent from the domain and wasn't changed on the way.
DMARC: A domain policy that tells recipients what to do with emails that fail SPF and DKIM checks: accept, send to spam, or reject.
DNS: The internet's "phone book": it turns a site name into a server address. Unprotected DNS requests can reveal which sites you visit.
Email alias: An extra address that forwards mail to your main inbox. It lets you hide your real address and switch the alias off if spam starts arriving.
Encryption: Transforming data so that it can only be read with a key. It protects messages, files and the connection to a site from outsiders.
End-to-end encryption (E2EE): Encryption where a message is decrypted only on the recipient's side. Even the service carrying it cannot read it.
EXIF: A block of metadata inside a photo: phone model, time of shooting and often exact GPS coordinates. It's best to remove it before publishing a photo.
GDPR: The EU's General Data Protection Regulation. It gives people the right to know what data is collected about them and to have it corrected or deleted.
Google Safe Browsing: A list of dangerous sites maintained by Google and used by most browsers. Checking against it catches known phishing and infected addresses, but not brand-new ones.
Hash: The result of an irreversible transformation of data into a short string. Services store password hashes rather than the passwords themselves; a hash can't be turned back into the text, but it can be compared.
HTTPS and TLS: Technology that encrypts the connection between your browser and a site. The padlock means data can't be snooped on the way, but it doesn't guarantee that the site itself is honest.
IP address: The numeric address of your internet connection. Sites use it to work out your approximate location and provider.
Malware: Programs made to cause harm: viruses, spyware, ransomware. They most often reach a device through email attachments and infected sites.
Metadata: Data about data: who created a file, when, on which device, where. The metadata of photos and documents often reveals more than the content itself.
One-time code (OTP): A numeric code valid for a single use or a few minutes, sent to confirm a sign-in or sign-up. Never share such a code — real service staff never ask for it.
Passkey: A passwordless way to sign in: your device confirms you with a fingerprint, face or PIN. The key is bound to the site, so it can't be tricked out of you on a phishing page.
Password manager: A program that stores all your passwords in encrypted form and fills them in for you. It lets you use a long unique password on every site while remembering only one master password.
Phishing: A scam where attackers pretend to be a bank, a service or someone you know and get you to enter a password or card details on a fake page. It usually arrives as an email or message with a link.
Proxy server: An intermediary between you and a site: the site sees the proxy's address, not yours. Unlike a VPN, it usually doesn't encrypt all of your device's traffic.
Quishing: Phishing through QR codes: instead of a link in an email or on a flyer, there is an image that leads to a fake site. The catch is that you can't see the address before scanning.
Social engineering: Manipulating people instead of hacking machines: a call "from your bank", an email "from your boss", urgency and pressure. The goal is to make you hand over a password, a code or money yourself.
Spam: Mass unwanted mailings. Your address ends up in spammers' databases when you leave it on sites that sell or lose user data.
SPF: A DNS record where a domain lists the servers allowed to send mail on its behalf. It helps filter out forged senders.
Temporary (disposable) email: An email address created in seconds without signing up, that lives for a limited time. It lets you avoid giving your real address to sites you don't trust, and avoid the spam that follows.
Tracking pixel: An invisible 1-pixel image in an email or on a page. When it loads, the sender learns that you opened the email, when, and from which device.
Two-factor authentication (2FA): Signing in with two proofs: a password plus a second factor — a code from an app, an SMS or a physical key. Even if the password is stolen, the attacker can't get in without the second factor.
Typosquatting: Registering sites with addresses that look like real ones (gooogle.com instead of google.com), counting on a typo or a lapse of attention.
URL shortener: A service that turns a long link into a short one. Convenient, but it hides the real address, so short links from emails are worth checking before you click.
VPN: A service that routes your traffic through its own server and hides your real IP from the sites you visit and from your provider. It helps on public networks, but doesn't make you anonymous by itself.
Zero-knowledge: An approach where the service technically cannot read your data: the encryption key stays only with you. Secret notes on this site work this way.