Glossary

Cybersecurity Glossary

Dark web, Tor, privacy and cybersecurity terms, defined in plain English — no jargon, no assumed knowledge. If a guide on this site uses a word you do not know, you will find it here.

By Abdul Hannan · Published 2026-11-14 · Last updated 2026-11-14

What the glossary is

This is the site's dictionary: every technical term our guides use, defined in one or two sentences. It covers the dark web and Tor, networking, privacy, encryption, cybersecurity and threat intelligence — the six areas this site teaches. Where a term is commonly misunderstood, the definition says what it is not, as well as what it is. 77 terms are defined below, and 19 of them have a full term page of their own — click a term name to open it.

How to use it

Use your browser's find function (Ctrl+F or Cmd+F) and type the word you are looking for — that is the searchable index for this glossary. The terms are also grouped into six categories below, so if you are learning one area, you can read its terms together. Each definition links, through the hubs at the bottom of this page, to the guide that explains the idea in full.

The six categories

Networking — how data moves: relays, exit nodes, proxies and the layers of the web.

Privacy — what is collected about you when you browse: tracking, fingerprinting and metadata.

Encryption — how messages and files are scrambled and unscrambled, and how that differs from hashing and encoding.

Cybersecurity — the attacks and the defences: phishing, malware, ransomware, breaches and account security.

Threat intelligence — how security teams track vulnerabilities and incidents: CVEs, SOCs and OSINT.

Dark Web terminology — the words specific to Tor and onion services: onion routing, .onion addresses and relays.

All terms

Networking

How data moves: relays, exit nodes, proxies and the layers of the web.

• Relay — A volunteer-run computer that passes your Tor connection along to the next step.
• Exit node — The last Tor relay in a circuit: the one that connects to the ordinary website you are visiting.
• Proxy — A server between you and a website that passes requests along and can hide your address; unlike a VPN, it usually protects only one app or connection.
• Guard node — The first relay in a Tor circuit: the one that sees your address, but not the website you are visiting.
• Middle relay — The second relay in a Tor circuit: it sees neither your address nor your destination, only the relay before and after it.
• Circuit — The route your Tor connection takes: three relays chosen by your Tor software, rebuilt regularly.

Privacy

What is collected about you when you browse: tracking, fingerprinting and metadata.

• Fingerprinting — Identifying your browser or device from its combined settings — screen size, fonts, language and more — without using cookies.
• Metadata — Data about data: who sent a message, when, from where, and how big it was — even when the message itself is encrypted.
• Anonymity — Being unidentifiable: hiding who you are. Stronger than privacy, and much harder to achieve.
• Pseudonymity — Using a consistent false name or identity, so your activity can be linked together without revealing who you really are.
• Digital footprint — The trail of information you leave online: accounts, posts, photos, and data collected about you without you doing anything.

Encryption

How messages and files are scrambled and unscrambled, and how that differs from hashing and encoding.

• Encryption — Scrambling data with a key so only someone with the key can read it; reversible by design.
• End-to-end encryption — Encryption where only the sender and recipient hold the keys, so nobody in the middle can read the message.
• Hash — A fixed-length fingerprint made from data; changing one letter of the input changes the whole hash, and the process cannot be reversed.
• Symmetric encryption — Encryption that uses one shared key to scramble and unscramble data; fast, but the key must be shared safely.
• Asymmetric encryption — Encryption that uses a key pair: a public key anyone can use to scramble, and a private key only the recipient holds.
• Public key — The half of an asymmetric key pair that can be shared freely: anyone can use it to encrypt a message to you.
• Private key — The half of an asymmetric key pair that must stay secret: only its holder can decrypt messages sent to the public key.
• Cipher — A method for scrambling a message — the algorithm itself — as distinct from the key that drives it.
• Plaintext — Ordinary, readable text before it is encrypted.
• Ciphertext — Scrambled text after encryption: unreadable without the right key.
• Key exchange — The process by which two parties agree on a shared secret key over a connection that may be watched.
• Digital signature — A cryptographic mark proving a message came from the holder of a private key and was not changed on the way.
• Salt — Random data added to a password before hashing, so two identical passwords produce different hashes.
• Password entropy — The measure of how hard a password is to guess, counted in bits; each extra bit doubles the guessing work.

Cybersecurity

The attacks and the defences: phishing, malware, ransomware, breaches and account security.

• Phishing — A message pretending to be from a trusted sender, trying to trick you into giving up passwords, money or personal details.
• Malware — Software designed to harm a computer or its owner: viruses, spyware and similar programs.
• Ransomware — Malware that locks your files or computer and demands payment to unlock them.
• Breach — An incident in which data is copied or exposed without permission, for example when a company's customer database is stolen.
• Passkey — A login method that replaces passwords with a cryptographic key pair stored on your own device.
• Two-factor authentication — A second check after your password, such as a code from an app or a security key, that proves it is really you logging in.
• Multi-factor authentication — Signing in with two or more independent checks — something you know, something you have, or something you are.
• Authenticator app — An app that generates time-based sign-in codes, usually changing every thirty seconds, as a second factor.
• Security key — A small physical device you plug in or tap to prove it is really you signing in; the strongest second factor.
• Social engineering — Manipulating people into giving up information or access, instead of breaking the technology to get it.
• Pretexting — Inventing a scenario — a support ticket, an audit, a delivery problem — to justify a request for information.
• Business email compromise (BEC) — Impersonating a senior colleague or a supplier by email to redirect a payment or steal credentials.
• Quishing — Phishing that hides the malicious link in a QR code, so the link cannot be inspected by hovering over it.
• Spear phishing — Phishing aimed at one specific person, using details gathered about them to make the message convincing.
• Smishing — Phishing by text message, often pretending to be a delivery notice or a bank alert with a link to tap.
• Vishing — Phishing by voice call, where the caller pretends to be from a bank, a company or a government office.
• Spyware — Malware that secretly watches what you do — keystrokes, browsing, credentials — and sends it to an attacker.
• Trojan — Malware disguised as legitimate software, which opens a way into the computer once it is installed.
• Worm — Malware that spreads on its own from one computer to another across a network, without needing a host program.
• Virus — Malware that attaches itself to other programs and spreads when those programs run.
• Adware — Software that floods you with unwanted advertising, often installed silently alongside a free program.
• Keylogger — A program or device that records keystrokes, which is how passwords and card numbers are captured.
• Botnet — A network of computers infected with malware and controlled remotely, usually to send spam or attack other sites.
• Brute-force attack — Trying every possible password or key in turn until one works; defeated by long, unpredictable passwords.
• Dictionary attack — Trying words from a dictionary and common passwords first, because people so often choose them.
• Credential stuffing — Trying passwords stolen in one breach against other services, on the assumption that people reuse them.
• Password manager — A program that stores your passwords in an encrypted vault and generates long, unique ones for every account.
• Passphrase — A password made of several random words: long, high in entropy, and easier to remember than a short complex string.
• Antivirus — Software that scans for known malware and watches for suspicious behaviour on your computer.
• Backup — A copy of your data kept separate from the original, so a lost, stolen or encrypted computer is not a disaster.
• Data leak — Data exposed by accident — for example a database left open on the internet — rather than stolen in an attack.

Threat intelligence

How security teams track vulnerabilities and incidents: CVEs, SOCs and OSINT.

• CVE — Common Vulnerabilities and Exposures: the public numbering system that gives each known software vulnerability its own ID.
• SOC — Security Operations Centre: the team in an organisation that watches for security alerts and responds to incidents.
• OSINT — Open-source intelligence: information gathered from public sources only — never by bypassing logins, passwords or access controls.
• MITRE ATT&CK — A public framework that organises attacker behaviour into tactics and techniques, giving each a shared name and ID.
• Zero-day — A vulnerability that is unknown to the software's maker and has no fix yet, so there is no defence prepared for it.
• Vulnerability — A weakness in software or a system that an attacker can exploit to do something the system was not designed to allow.
• Exploit — A method of taking advantage of a vulnerability. This site describes vulnerabilities in general terms and never publishes exploit code.
• Patch — A fix issued by a software maker to close a vulnerability; applying updates promptly is the main defence against known flaws.
• Threat actor — A person or group that carries out or sponsors cyberattacks — used when the attribution is confirmed, never as a guess.
• Threat intelligence — Knowledge about attackers, their methods and their targets, gathered so defenders can prepare rather than react.
• Attack surface — All the points where an attacker can try to enter a system: every open port, login, file upload and forgotten account.
• Incident response — The planned sequence of steps an organisation follows when an attack is discovered: contain, investigate, recover.

Dark Web terminology

The words specific to Tor and onion services: onion routing, .onion addresses and relays.

• Tor — A free, volunteer-run network that routes your connection through several relays, so no single relay knows both who you are and where you are going.
• Onion routing — The technique Tor uses: your message is wrapped in layers of encryption, and each relay peels off one layer.
• .onion — The address ending used by onion services, reachable only through Tor.
• Dark web — The small part of the internet made of sites that need special software, usually Tor Browser, to reach.
• Deep web — Everything search engines do not index, such as your email inbox and online banking.
• Surface web — The public internet that search engines index: news sites, blogs and public pages.
• VPN — A virtual private network: a service that routes your traffic through its own server, hiding your real address from sites and your browsing from your local network.
• Onion service — A website or service that lives inside the Tor network, reached through a .onion address, so neither side learns the other's address.
• Tor Browser — A web browser based on Firefox that routes your connection through the Tor network and blocks trackers.

Term pages

19 terms have a full page — a simple definition, a technical explanation, an example, related terms and links to the guides where the term matters most. The rest are defined above in the searchable index. If a guide uses a word that is not defined here, that is a gap in our writing, and you can report it through our contact page.

Frequently asked questions

What is the difference between the deep web and the dark web?

The deep web is everything search engines do not index — your email, online banking, paywalled articles. The dark web is a small part of the deep web: sites that need special software, usually Tor Browser, to reach. Most of the deep web is ordinary, everyday content.

Is encryption the same as hashing?

No. Encryption scrambles data so it can be unscrambled later with the right key — it is reversible. Hashing turns data into a fixed-length fingerprint that cannot be reversed; it is used to check whether something changed, and to store passwords safely. Encoding, like Base64, is neither: it just changes how data is written down.

Which terms have their own page?

19 terms have a full term page — a simple definition, a technical explanation, an example, related terms and links to the guides where the term matters most. Click a term name below to open its page. The remaining terms are defined here in the glossary index, and grow into full pages as the site grows.

Why do some terms have more than one meaning?

Because people use them loosely. "Hacker" can mean a criminal or a security researcher; "dark web" is often used when someone means the deep web. Where a term is commonly misused, the definition below says so plainly and points to the more precise word.