Private information that software must protect from people and systems that should not see or use it.
A secret is a private value that software uses to prove identity, authorize an operation, or protect a secure system.
Examples include passwords, API credentials, signing keys, encryption keys, and connection strings.
Simple Definition:
A secret is private information that should not be exposed.
Think of a secret like the combination to a locked safe.
The combination lets an authorized person open the safe.
Anyone who learns it may be able to access what the safe protects.
Good security keeps the combination out of public notes, code, and messages.
Analogy:
A secret gives software a private value it can use during a security-sensitive operation.
Show that a caller knows or controls a protected value.
Help restrict data, services, or actions to approved callers.
Support signing, encryption, or secure connections between systems.
Keep sensitive values separate from public code and ordinary user data.
Secrets are used wherever software needs private configuration or protected communication.
Store database URLs, service credentials, and other deployment-specific values outside source code.
Help users or services prove identity during a controlled security flow.
Protect messages, verify integrity, or establish trusted connections.
Allow one application to call a provider while keeping the credential restricted.
PAYMENTS_API_KEY=sk_live_example_key DATABASE_URL=postgres://app:password@example/db
The application reads these values from protected runtime configuration. The values are not committed to a public repository or displayed in browser code.
These values are fictional examples. Real secrets should be stored in a secret manager or protected environment configuration, and rotated when exposure is suspected.
The application receives a secret through a controlled runtime path, uses it for the required operation, and keeps it out of logs, public responses, and client-side code.
Private information that must be protected from unauthorized exposure.
Data transformed so it cannot be read without the required key or process.
A value meant to identify a resource or client and safe to share in its intended context.
A secret is defined by the need to keep it private; encryption is one way to protect data, not a replacement for careful secret handling.
| ENGLISH TERM | 中文 | SIMPLE ENGLISH | 中文小白理解 |
|---|---|---|---|
| Secret | 机密信息 | Private information that should not be exposed. | 不应该公开或泄露的私密信息。 |
| Credential | 凭证 | Information used to prove identity or represent access. | 用来证明身份或表示访问权限的信息。 |
| Secret Store | 密钥存储 | A protected system for storing and retrieving secrets. | 专门安全保存和取出机密信息的系统。 |
| Environment Variable | 环境变量 | A named value supplied to an application by its runtime environment. | 由运行环境提供给应用程序的一组命名配置值。 |
| Encryption Key | 加密密钥 | A value used to encrypt or decrypt protected data. | 用来加密或解密受保护数据的一串值。 |
| Signing Key | 签名密钥 | A key used to create or verify a digital signature. | 用来生成或验证数字签名、确认内容来源和完整性的密钥。 |
| Rotation | 轮换 | Replacing a secret with a new value on a planned basis. | 按计划用新的机密值替换旧值。 |
| Revocation | 撤销 | Making a credential or secret no longer valid. | 让某个凭证或机密值失效、不能再使用。 |
A secret is private information that software protects and uses for security-sensitive operations.
Keep secrets out of public code, browser bundles, logs, and ordinary messages.
Core Rule:
Store privately → Use narrowly → Rotate when needed