This is a research guide based on cited documentation. It is not a report of firsthand testing. Our editorial method
How to use this glossary
Each entry gives a one-line definition, where you will see the term in Bitwarden, 1Password or NordPass, and why it matters to an ordinary user. Definitions come from vendor help pages, the vendor security white papers, NIST and the FIDO Alliance. Where only one vendor uses a term, the entry says so.
Encryption and keys
| Term | Plain-English definition | Where you see it | Why it matters |
|---|---|---|---|
| Vault | The encrypted store of your passwords, notes, cards and other items. | 1Password lets you have several vaults and share them; Bitwarden and NordPass use the term for your whole store. | Sharing and permissions are usually set per vault, folder or collection. |
| Master password | The one password that unlocks the vault; 1Password calls it the account password. | Sign-up and unlock screens in all three. | No vendor can reset it, so losing it can mean losing the vault. |
| Secret Key | A 34-character random code 1Password combines with your account password; it has 128 bits of entropy. | 1Password Emergency Kit and signed-in devices. | Stolen 1Password server data cannot be used to test password guesses without it. |
| Key derivation function (KDF) | A deliberately slow process that turns your master password into an encryption key. | Bitwarden web app: Settings, Security, Keys. | Slowness makes every guess by an attacker expensive. |
| PBKDF2 | A widely used KDF that repeats a hash many times. | Bitwarden default at 600,000 iterations; 1Password uses 650,000. | The standard choice; 1Password Bitwarden importer requires it. |
| Argon2id | A newer KDF that also uses a chosen amount of memory, which is hard to accelerate. | Optional in Bitwarden (defaults 32 MiB, 6 iterations, 4 threads); used by NordPass. | Higher memory raises attacker cost but can slow older phones. |
| Iterations | How many times a KDF repeats its work. | Bitwarden KDF settings; 1Password white paper. | More iterations mean slower unlocks for you and slower guessing for attackers. |
| Salt | A non-secret value mixed into the password before hashing so identical passwords produce different keys. | Bitwarden uses your email; NordPass a unique 16-byte salt. | Stops attackers reusing precomputed guess tables. |
| Zero-knowledge | A design where the vendor never has the keys to read your data. | Bitwarden and NordPass security pages and white papers. | It is why the vendor cannot read your vault and cannot recover it for you. |
| End-to-end encryption | Data is encrypted on your device and only decrypted on a device you unlock. | Bitwarden white paper; 1Password security page. | A copy of the vendor database is ciphertext without your key. |
| AES-256 | A standard symmetric cipher with 256-bit keys. | Bitwarden (AES-CBC with HMAC) and 1Password (AES-256-GCM). | The vault cipher; you do not choose or configure it. |
| XChaCha20 | A fast stream cipher, paired with Poly1305 for authentication. | NordPass white paper. | NordPass alternative to AES; you do not configure it. |
Signing in and getting back in
| Term | Plain-English definition | Where you see it | Why it matters |
|---|---|---|---|
| Emergency Kit | A 1Password PDF with your sign-in address, email, Secret Key, a space for your password and a Setup Code. | 1Password.com: your name, Manage Account, Save Emergency Kit. | Without the Secret Key on it, a new device cannot sign in. |
| Recovery code | A one-time code that restores access when another secret is lost. | NordPass: 24-character code that resets the Master Password. Bitwarden: resets two-step login. 1Password: optional account recovery code. | Each vendor uses it for something different; know which one you hold. |
| Emergency access | A trusted contact who can request to view or take over your vault after a wait time. | Bitwarden (Premium) and NordPass Settings, Other, Emergency access (Premium or Family). | The cleanest way to pass on a vault without sharing your master password. |
| Two-step login (2FA) | A second check, such as a code or key, on top of the password. | Bitwarden: Settings, Security, Two-step login. 1Password and NordPass: MFA settings. | Protects sign-in to the account; it does not change vault encryption. |
| TOTP | Time-based one-time password: a six-digit code that changes every 30 seconds. | Bitwarden integrated authenticator (generation needs Premium); NordPass Authenticator (Premium). | Keeping codes in the vault is convenient but puts both factors in one place. |
| Security key | A physical USB, NFC or Bluetooth device used as a second factor. | Bitwarden FIDO2 (free); 1Password (YubiKey, Titan); NordPass MFA option. | Built on FIDO standards, which the FIDO Alliance designs to resist phishing. |
| Biometric unlock | Unlocking with a fingerprint or face instead of typing the master password. | Offered in all three apps on supported devices. | Convenient, but it does not replace the master password, which you still need. |
| Passkey | A sign-in credential based on FIDO standards that replaces a password with a key pair. | Stored in all three vaults; NordPass says its passkeys cannot be imported or exported to other password managers. | Phishing-resistant, but harder to move between managers today. |
| FIDO2 and WebAuthn | The standards behind passkeys and security keys; WebAuthn is the browser part. | Bitwarden two-step login options; FIDO Alliance documentation. | If a site supports WebAuthn, it can accept passkeys or security keys. |
Features you will see in the app
| Term | Plain-English definition | Where you see it | Why it matters |
|---|---|---|---|
| Autofill | The app enters saved usernames and passwords into sign-in forms for you. | Browser extensions and phone autofill settings in all three. | Check where it works before relying on it; NordPass, for example, does not fill desktop programs. |
| Send | A Bitwarden feature for sharing text or files through encrypted, expiring links. | Bitwarden; text up to 1,000 characters, files up to 500 MB (100 MB on mobile) using Premium or organization storage, maximum lifespan 31 days. | A safer way to send a password to someone who does not use Bitwarden. |
| Watchtower | 1Password security dashboard. | 1Password sidebar. | Flags compromised sites, reused, weak and exposed passwords, missing 2FA and passkeys. |
| Data Breach Scanner | NordPass tool that checks whether your email addresses or card numbers appear in leaked databases. | NordPass, bottom left or Tools on mobile (Premium). | Tells you which accounts to change first after a breach. |
| Password health | A report of weak, reused and exposed passwords. | NordPass Password Health; Bitwarden Reports in the web app. | Your to-do list for cleaning up old habits. |
Sharing and business terms
| Term | Plain-English definition | Where you see it | Why it matters |
|---|---|---|---|
| Organization and collection | In Bitwarden, an organization is a shared account for a family or team; collections are the shared groups of items inside it. | Bitwarden Families, Teams and Enterprise. | Items owned by an organization are not in your personal export. |
| Self-hosting | Running the password manager server on your own hardware. | Bitwarden: Linux server with Docker, minimum 2 GB RAM and 12 GB storage. | Full control, but you own the updates, backups and uptime. |
| SSO (single sign-on) | Signing in with your company identity provider instead of a separate password. | Bitwarden Enterprise (SAML 2.0 or OIDC); 1Password Unlock with SSO. | In Bitwarden, SSO handles sign-in while a separate method decrypts the vault. |
| SCIM | An automatic way for a company identity system to add and remove users and groups. | Bitwarden organizations: Admin Console, Settings, SCIM provisioning. | Leavers lose access as soon as they are deactivated upstream. |
Five terms people mix up
- Master password versus account password: in 1Password they are the same thing. In NordPass they are different: the Nord Account password signs you in, the Master Password unlocks the vault.
- Recovery code: in NordPass it resets the Master Password; in Bitwarden it switches off two-step login; in 1Password it restores account access if you generated one.
- Two-step login versus TOTP in the vault: the first protects your password manager account; the second is the vault generating codes for other sites.
- Emergency Kit versus emergency access: the kit is a document you keep; emergency access is a feature that grants another person access after a wait.
- Passkey versus security key: both use FIDO standards, but a passkey replaces the password, while a security key is usually a second factor alongside it.
Questions before you decide
What does zero-knowledge mean in a password manager?
The vendor never holds the keys needed to decrypt your vault. Bitwarden says it never stores or accesses your master password or keys, which is also why it cannot reset a forgotten master password.
What is the difference between PBKDF2 and Argon2id?
Both turn your master password into a key slowly. PBKDF2 repeats a hash many times, 600,000 by default in Bitwarden. Argon2id also consumes memory, which makes mass guessing on specialised hardware harder.
Is a passkey the same as two-factor authentication?
No. The FIDO Alliance describes a passkey as an authentication credential based on FIDO standards that lets you sign in without a password, approving the sign-in the same way you unlock your device. Two-factor authentication adds a second check on top of a password.
What is a 1Password Secret Key?
A 34-character code with 128 bits of entropy that 1Password combines with your account password. It is stored on your signed-in devices and in your Emergency Kit; 1Password has no copy.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Bitwarden: security whitepaper Accessed 30 Oct 2026
- Bitwarden: encryption key derivation (KDF algorithms) Accessed 30 Oct 2026
- 1Password: glossary Accessed 30 Oct 2026
- 1Password: about your Secret Key Accessed 30 Oct 2026
- 1Password security white paper (PDF) Accessed 30 Oct 2026
- 1Password: get to know your Emergency Kit Accessed 30 Oct 2026
- NordPass security white paper (business, PDF) Accessed 30 Oct 2026
- NordPass: what is a Recovery Code? Accessed 30 Oct 2026
- NIST SP 800-63B-4: authentication and authenticator management Accessed 30 Oct 2026
- FIDO Alliance: passkeys Accessed 30 Oct 2026
- Bitwarden: two-step login methods Accessed 30 Oct 2026
- Bitwarden: recovery code for two-step login Accessed 30 Oct 2026
- Bitwarden: integrated authenticator Accessed 30 Oct 2026
- Bitwarden: emergency access Accessed 30 Oct 2026
- Bitwarden: about Send Accessed 30 Oct 2026
- Bitwarden: vault health reports Accessed 30 Oct 2026
- Bitwarden: about login with SSO Accessed 30 Oct 2026
- Bitwarden: about SCIM Accessed 30 Oct 2026
- Bitwarden: install and deploy on Linux (self-host) Accessed 30 Oct 2026
- 1Password: Watchtower Accessed 30 Oct 2026
- 1Password: use two-factor authentication Accessed 30 Oct 2026
- NordPass: how to give Emergency Access Accessed 30 Oct 2026
- NordPass: how to use NordPass Authenticator Accessed 30 Oct 2026
- NordPass: how to use the Data Breach Scanner Accessed 30 Oct 2026
- NordPass: how to use Password Health Accessed 30 Oct 2026
- NordPass: forgot Master Password and no recovery code Accessed 30 Oct 2026
- NordPass: what is autofill and how does it work Accessed 30 Oct 2026
- NordPass: passkeys FAQs Accessed 30 Oct 2026
- NordPass: Premium vs Free version Accessed 30 Oct 2026
- Bitwarden: Export vault data Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.