A secret that a user provides to help prove their identity during sign-in.
A password is a secret value that a user knows and provides during authentication.
The application compares a protected representation of the submitted password with the stored representation. It should not store the original password as readable text.
Simple Definition:
A password is a user-held secret used to prove identity.
Think of a password like a secret phrase for a locked room.
The person says the phrase at the entrance. The entrance system checks it without displaying the protected secret. If the check succeeds, the person can continue.
A password supports the sign-in part of an authentication flow.
The sign-in form receives the password over a protected connection.
The server checks whether the secret matches the account record.
A successful check continues the login flow; a failed check returns an error.
Passwords are commonly used when an application needs a user to sign in with an account.
A user enters a known email or username and password.
A user chooses a password that the application can protect.
An authenticated user replaces an old password with a new one.
A recovery flow helps a user create a new password after forgetting the old one.
A user signs in to a web application.
The user enters an email address and password, then submits the sign-in form.
The server finds the account, checks the password securely, and continues the login flow only when the check succeeds.
The password should travel over HTTPS and should never be exposed in the page URL or returned in a response.
A password helps authenticate the user. A session or token usually carries the result of that authentication to later requests.
A secret that a user provides to prove knowledge during sign-in.
A one-way derived value used by the server to verify a password without storing the original.
State that helps the application remember a successful login across later requests.
A password is the secret used during authentication; it is not the same thing as the session that follows a successful login.
| ENGLISH TERM | 中文 | SIMPLE ENGLISH | 中文小白理解 |
|---|---|---|---|
| Password | 密码 | A secret value used during sign-in. | 登录时使用的一段秘密信息。 |
| Authentication | 身份认证 | The process of checking who a user is. | 判断用户是谁的过程。 |
| Sign-in | 登录 | The action of entering credentials to access an account. | 输入凭证以进入账户的操作。 |
| Password Hash | 密码哈希 | A derived value used to verify a password without storing the original. | 不用保存原始密码、而是用来验证密码的一种计算结果。 |
| Salt | 盐值 | Extra random data added before a password is hashed. | 哈希密码前加入的额外随机数据。 |
| Credential | 凭证 | Information used to prove or represent access. | 用来证明身份或表示访问权限的信息。 |
| Session | 会话 | State that helps a system remember a successful login. | 帮助系统记住用户已登录状态的信息或机制。 |
| Password Reset | 密码重置 | A flow for creating a new password after the old one is forgotten or changed. | 忘记或需要更改旧密码后重新设置新密码的流程。 |
A password is a user-held secret used to authenticate an account.
Applications should protect passwords with secure transport, one-way password hashing, and careful recovery flows.
Core Flow:
Password → Authentication Check → Session or Token → Protected Access