Glossary

A

Alt text

The alt attribute on an image, read aloud by screen readers and shown when the image fails to load. Required for accessibility.

API

Application Programming Interface. A defined way for one piece of software to call another, usually over HTTP for web services.

Argon2

A memory-hard password hashing function, winner of the 2015 Password Hashing Competition and the current recommended choice for storing passwords.

ASCII

American Standard Code for Information Interchange, 1963. A 7-bit character set of 128 codes covering English letters, digits, punctuation and control characters. See the ASCII table.

Aspect ratio

The proportion of width to height, written as w:h. 1920×1080 is 16:9. See the calculator.

B

Base64

An encoding that represents binary data using 64 ASCII characters, so it can travel through text-only channels. It adds about 33% to the size and provides no security. See the encoder.

Big-endian

Byte order where the most significant byte is stored first. Network protocols use it; most modern CPUs are little-endian.

Binary

Base-2 notation using only 0 and 1. Each position is worth twice the one to its right. See the beginner's guide.

Bit

A binary digit, the smallest unit of information: one of two states.

Bitwise operation

An operation applied to individual bits of an integer — AND, OR, XOR, NOT and shifts. See the bitwise calculator.

BOM

Byte Order Mark. A marker at the start of a file indicating encoding and byte order. Unnecessary in UTF-8 and often harmful.

Byte

Eight bits, holding 256 possible values. The smallest individually addressable unit of memory on modern machines.

C

Canonical URL

The preferred URL for a piece of content, declared with <link rel="canonical"> so duplicates consolidate onto one address.

CDN

Content Delivery Network. Geographically distributed servers that cache and serve content close to the user.

Character set

A mapping from characters to numbers. Unicode is a character set; UTF-8 is an encoding of it.

CIDR

Classless Inter-Domain Routing. Notation writing an IP network as address/prefix, such as 192.168.1.0/24. See the subnet calculator.

CLS

Cumulative Layout Shift. A Core Web Vital measuring unexpected movement of page content during loading. Under 0.1 is good.

Code point

A number assigned to a character by Unicode, written as U+ followed by hexadecimal, such as U+1F600.

Collision

Two different inputs producing the same hash output. Practical collisions exist for MD5 and SHA-1, which is why both are unsuitable for security.

Contrast ratio

The luminance relationship between two colours, from 1:1 to 21:1. WCAG AA requires 4.5:1 for body text. See the accessibility guide.

Core Web Vitals

Google's user-experience metrics: Largest Contentful Paint, Interaction to Next Paint and Cumulative Layout Shift.

Crawl budget

The number of URLs a search engine will fetch from a site in a given period. Relevant mainly to very large sites.

Cron

The Unix job scheduler, and the five-field expression format it uses. See the cron generator.

CSPRNG

Cryptographically Secure Pseudo-Random Number Generator. Unpredictable output suitable for keys and tokens, unlike Math.random().

CSV

Comma-Separated Values. A plain-text tabular format defined loosely by RFC 4180.

D

Digest

The fixed-length output of a hash function.

DNS

Domain Name System. Translates hostnames into IP addresses.

E

Endianness

The order in which bytes of a multi-byte value are stored.

Entropy

A measure in bits of unpredictability. Password entropy is length multiplied by log2 of the character set size. See the password guide.

Epoch

The zero point of a timestamp system. The Unix epoch is 1 January 1970 00:00:00 UTC. See the timestamp converter.

F

Favicon

The small icon shown in a browser tab and bookmark list.

G

Gzip

A lossless compression format applied at transfer time by web servers. Typically reduces text by 60–80%.

H

Hash function

A one-way function mapping input of any size to a fixed-size digest. See hashing vs encryption.

Hexadecimal

Base-16 notation using 0–9 and A–F. Each digit represents exactly four bits, so one byte is always two hex digits.

HMAC

Hash-based Message Authentication Code. Combines a hash with a shared secret to prove a message came from someone holding that secret.

Hreflang

An annotation declaring which language and region version of a page to show to which users. See the generator.

HTTPS

HTTP over TLS. Encrypts traffic between browser and server and is a lightweight ranking signal.

I

IEC prefix

Binary unit prefixes — KiB, MiB, GiB — based on powers of 1,024, as opposed to the decimal SI prefixes.

IP address

A numeric identifier for a device on a network. IPv4 uses 32 bits, IPv6 uses 128.

J

JSON

JavaScript Object Notation. A text data format defined by RFC 8259, mandated to be UTF-8.

JSON-LD

JSON for Linking Data. The format Google recommends for structured data. See the structured data guide.

JWT

JSON Web Token. A signed, base64url-encoded token carrying claims. Signed, not encrypted — anyone holding it can read it. See the decoder.

L

LCP

Largest Contentful Paint. A Core Web Vital measuring when the largest visible element finishes rendering. Under 2.5 seconds is good.

Little-endian

Byte order where the least significant byte comes first. Used by x86 and ARM processors.

M

MIME type

A label such as text/html declaring how to interpret a stream of bytes. See the reference.

Minification

Removing comments and whitespace from code to reduce file size without changing behaviour. See the minifier.

Mojibake

Garbled text produced by decoding bytes with the wrong character encoding.

N

Nibble

Four bits, or half a byte — exactly one hexadecimal digit.

Noindex

A robots directive telling search engines not to include a page in their index. Requires the page to be crawlable to be seen.

Normalisation

Converting Unicode text to a canonical form so visually identical strings compare equal. NFC is the usual choice.

O

Octal

Base-8 notation. Each digit represents three bits, which is why Unix file permissions are written this way.

Open Graph

A metadata protocol, introduced by Facebook in 2010, controlling how a link appears when shared. See the debugger.

P

Percent-encoding

Representing reserved characters in a URL as a % followed by two hex digits. Also called URL encoding.

Punycode

An ASCII encoding of internationalised domain names, producing hostnames prefixed with xn--.

R

Rainbow table

A precomputed lookup of hashes to inputs. Defeated entirely by salting.

Reed-Solomon

An error-correcting code that allows data to be recovered from partial damage. Used in QR codes, CDs and deep-space transmission.

Regular expression

A pattern describing a set of strings, used for searching, validating and replacing text. See the cheat sheet.

Robots.txt

A file at a site's root telling crawlers which paths they may fetch. It controls crawling, not indexing.

S

Salt

A unique random value added to each password before hashing, so identical passwords produce different hashes.

Schema.org

A shared vocabulary of types and properties for structured data, created in 2011 by Google, Microsoft, Yahoo and Yandex.

SERP

Search Engine Results Page. See the SERP preview tool.

SHA-256

A cryptographic hash function producing a 256-bit digest. Secure for integrity verification, but too fast to be used directly for passwords.

Slug

The human-readable portion of a URL identifying a specific page. See the slug generator.

Structured data

Machine-readable markup describing what a page's content means. See the guide.

Subnet mask

A 32-bit value marking which portion of an IPv4 address identifies the network. 255.255.255.0 corresponds to /24.

Surrogate pair

Two 16-bit UTF-16 code units encoding a single code point above U+FFFF. The reason an emoji has length 2 in JavaScript.

T

Timestamp

A number of seconds (or milliseconds) since an epoch. Unix timestamps count from 1 January 1970 UTC.

TLS

Transport Layer Security. The encryption underlying HTTPS, successor to SSL.

Two's complement

The standard representation of signed integers: negate by inverting every bit and adding one. Lets one circuit perform both addition and subtraction.

U

Unicode

A universal character set assigning a unique code point to every character in every writing system. See the blocks reference.

URL encoding

See Percent-encoding. Converts reserved characters into %XX sequences. See the encoder.

UTF-8

A variable-width encoding of Unicode using 1 to 4 bytes per character, backward-compatible with ASCII. Used by over 98% of web pages.

UTM parameters

Query parameters (utm_source, utm_medium, utm_campaign and others) that attribute traffic to a campaign. See the UTM builder.

UUID

A 128-bit identifier that can be generated independently with negligible collision risk. See the generator.

W

WCAG

Web Content Accessibility Guidelines. The W3C standard most accessibility legislation references. Level AA is the usual requirement.

WebP

An image format typically 25–35% smaller than JPEG at equivalent quality, supported by all current browsers.

X

XML sitemap

A file listing the URLs on a site that you want crawled. See the generator.

XSS

Cross-Site Scripting. An attack where unescaped user input executes as script. Prevented by context-appropriate output escaping.

Y

Y2K38

The overflow of signed 32-bit Unix timestamps on 19 January 2038.

YAML

A human-readable data serialisation format used mainly for configuration. See the converter.