Developer Glossary

#

3DES 3DES (Triple DES, TDEA) runs the DES cipher three times per 64-bit block. NIST withdrew its guidance on January 1, 2024, and Sweet32 broke i

A

AbortController AbortController is the DOM object that cancels fetch requests, event listeners and other async work by aborting its AbortSignal with a reaso
ACID ACID is the set of four database transaction guarantees: atomicity, consistency, isolation and durability. It keeps data correct through err
AES AES (Advanced Encryption Standard) is a symmetric block cipher with 128-bit blocks and 128, 192 or 256-bit keys, standardized by NIST in FIP
AES-CBC AES-CBC is the cipher block chaining mode of AES. It needs a random 16-byte IV and PKCS#7 padding, and it does not detect tampering without
AES-CFB AES-CFB is the AES Cipher Feedback mode from NIST SP 800-38A. It feeds ciphertext back into the cipher and re-synchronizes after errors.
AES-CTR AES-CTR is the AES counter mode from NIST SP 800-38A. It turns AES into a stream cipher with no padding, and it never detects tampering by i
AES-GCM AES-GCM is the AES mode from NIST SP 800-38D that encrypts with counter mode and adds a 16-byte authentication tag. A 96-bit IV is standard.
AES-OFB AES-OFB is the AES Output Feedback mode from NIST SP 800-38A. It makes AES a stream cipher whose keystream ignores the data, and it has no i
API key An API key is a secret string a client sends with each request so an API can identify the calling project and apply its quota. Learn formats
ASCII ASCII is a 7-bit character encoding with 128 codes: 95 printable characters and 33 non-printing codes. It is the base layer of UTF-8.
AST An AST (abstract syntax tree) is a tree of nodes that represents the structure of source code. Compilers, linters, formatters and transpiler
Autokey Cipher The Autokey cipher starts with a short keyword and then uses the plaintext itself as the rest of the key, so the key never repeats within on

B

Base64 Binary-to-text encoding that represents arbitrary bytes as 64 printable ASCII characters.
Blob A Blob is an immutable, raw-bytes object with a size and a MIME type, defined by the File API, used for files, downloads, uploads and object

C

Caesar Cipher The Caesar cipher shifts every letter a fixed number of places in the alphabet. With only 25 usable keys it is trivial to break and offers n
Canonical URL A canonical URL is the preferred address of a page that has duplicate versions. Search engines use it to pick which one to index and show in
Canvas The HTML canvas element, a pixel bitmap that JavaScript draws on through a 2D or WebGL rendering context.
Capture group Parenthesized sub-pattern in a regex whose match can be extracted or backreferenced.
ChaCha20 ChaCha20 is a 256-bit stream cipher from RFC 8439 with a 96-bit nonce and a 32-bit block counter. It is the cipher half of ChaCha20-Poly1305
Chroma subsampling Storing color at lower resolution than brightness to shrink images and video, as in 4:2:0 JPEG, WebP and MPEG-2.
Clipboard API The Clipboard API lets a web page read and write the system clipboard asynchronously through navigator.clipboard, in secure contexts and aft
CMYK CMYK is the cyan, magenta, yellow and black ink model used in print. Values run 0% to 100%, and converting to RGB needs a printer profile.
Color blindness Color blindness, or color vision deficiency, is reduced ability to tell some colors apart. About 1 in 12 men are affected, so color cannot c
Color gamut A color gamut is the range of colors a device or color space can show. sRGB is the web default and Display P3 is wider; color-gamut media qu
Color management Color management uses color profiles, such as ICC profiles, to keep colors consistent across devices. Profiles map device values to a shared
Container queries Container queries apply CSS based on the size of an ancestor query container instead of the viewport, so a component adapts to the space it
CORS Browser mechanism that relaxes the same-origin policy to allow controlled cross-domain HTTP requests.
CRLF CRLF is the two-byte line ending carriage return plus line feed (0x0D 0x0A) used by HTTP, email, and CSV.
Cron expression Five-field schedule syntax (minute hour day month weekday) used to run recurring jobs on Unix.
crypto.getRandomValues crypto.getRandomValues fills an integer typed array with cryptographically strong random bytes, up to 65,536 bytes per call, in browsers and
crypto.subtle crypto.subtle is the browser SubtleCrypto object for hashing, signing, encrypting and key handling with the Web Crypto API, in secure contex
CSRF CSRF (cross-site request forgery) makes a logged-in user's browser send an unwanted request to a site that trusts their cookies.
CSS anchor positioning CSS anchor positioning places an absolutely positioned box, such as a tooltip or menu, relative to another element using anchor-name and pos
CSS animation CSS animation runs a multi-step motion defined by @keyframes on an element, with control over timing, repeats, direction and fill.
CSS aspect-ratio The CSS aspect-ratio property sets a preferred width-to-height ratio such as 16 / 9, so a box keeps its shape when only one dimension is kno
CSS calc() CSS calc() is a math function that lets you add, subtract, multiply and divide lengths and percentages with mixed units inside a property va
CSS cascade The CSS cascade is the algorithm that picks one winning value per property per element from competing declarations, by origin, layer, specif
CSS cascade layers CSS cascade layers, declared with @layer, let you set an explicit priority order between groups of rules so that order beats selector specif
CSS clamp() CSS clamp(MIN, VAL, MAX) is a math function that returns a preferred value but never lets it go below a minimum or above a maximum.
CSS color() Function The CSS color() function writes a color in a named color space such as display-p3, rec2020 or xyz, so you can reach beyond the sRGB gamut.
CSS Grid CSS Grid is a two-dimensional CSS layout system that places items into rows and columns using display: grid.
CSV Plaintext tabular format with comma-separated fields, one record per line.

D

Debounce Debounce delays a function until calls stop for a set wait time, so a burst of events such as keystrokes runs once instead of many times.
DES DES (Data Encryption Standard) is a 64-bit block cipher with a 56-bit key, withdrawn by NIST in 2005 and broken by brute force in 1998-1999.
Dilithium Dilithium is the lattice-based signature scheme NIST standardized as ML-DSA in FIPS 204. It signs data in a way that quantum computers are n
DNS Hierarchical system that resolves human-readable domain names to IP addresses.
Docker Container platform that packages an app and its dependencies into a portable, isolated image.
DOM The DOM (Document Object Model) is the in-memory tree of nodes a browser builds from HTML, which JavaScript reads and changes through standa

E

ECC ECC (elliptic curve cryptography) builds keys and signatures from points on a curve, matching RSA strength with far shorter keys. P-256 is t
ECDSA ECDSA signs data with an elliptic curve key and outputs two integers, r and s. A P-256 signature is 64 bytes raw or 70 to 72 bytes in DER.
Ed25519 Ed25519 is an EdDSA signature scheme on Curve25519 with 32-byte public keys and 64-byte signatures. It is deterministic, about 128-bit stren
Ed448 Ed448 is the EdDSA signature on the edwards448 curve with SHAKE256, 57-byte keys, 114-byte signatures and about 224-bit security. It is defi

F

Fetch API The Fetch API is the promise-based browser interface for HTTP requests, built on fetch(), Request and Response and defined by the WHATWG Fet
File API The File API is the W3C browser spec defining Blob, File, FileList and FileReader, so pages can read user-selected files without uploading t
FileReader FileReader is the browser API that reads a Blob or File asynchronously into text, an ArrayBuffer or a base64 data URL, reporting progress th
Flexbox Flexbox (CSS Flexible Box Layout) lays out items in one row or column and distributes free space among them, set with display flex on the co
FormData FormData is the browser object that holds form fields as name and value pairs, including files, and sends them as a multipart/form-data requ

G

Geolocation API The Geolocation API lets a web page ask for the device position as latitude, longitude and accuracy, after the user grants permission over H
Git Git is a free, distributed version control system that records snapshots of your project history, so you can branch, merge and undo changes
GraphQL Typed query language and runtime that lets API clients request exactly the fields they need.

H

Hex color Color written as hexadecimal RGB(A) values (e.g. #ff0000), the standard CSS color notation.
HMAC Keyed hash construction that proves both data integrity and the sender's identity.
Hreflang Hreflang is an HTML attribute that tells search engines which language or region each version of a page targets, so users see the matching o
HSL HSL describes a color by hue angle, saturation and lightness. In CSS, hsl(217 91% 60%) is a blue; 0deg is red, 120deg green, 240deg blue.
HSV HSV describes a color by hue, saturation and value, where value is the largest RGB channel. Also called HSB, it drives most color-picker squ
HTTP HTTP (Hypertext Transfer Protocol) is the stateless request and response protocol the web runs on, defined by RFC 9110, with versions 1.1, 2
HTTPS HTTPS (HTTP Secure) is HTTP carried over a TLS connection on port 443, giving server authentication, encryption and tamper protection.

I

Idempotent Idempotent means repeating an operation leaves the server in the same state as running it once, which makes retries safe. Learn the HTTP rul
Idle Detection API The Idle Detection API tells a web page when the user has stopped interacting with the device or locked the screen, after a permission promp
ISO 8601 International date/time format (YYYY-MM-DDTHH:MM:SSZ) that avoids locale-dependent ambiguity.

J

JSON Lightweight, text-based data format using key-value pairs and arrays to represent structured data.
JWT Compact, signed token format (header.payload.signature) used to carry authentication claims.

K

Kyber Kyber is the lattice-based key-encapsulation scheme NIST standardized as ML-KEM in FIPS 203. It sets up shared keys that resist quantum comp

L

Lab color Lab color is the CIELAB space: lightness L from 0 to 100 plus a (green to red) and b (blue to yellow) axes. CSS writes it as lab().
LCH color LCH color is the polar form of CIE Lab: lightness, chroma and a hue angle in degrees. CSS writes it as lch(54.62% 66.37 277.6).
Lookahead Zero-width regex assertion that checks what follows a position without consuming those characters.

M

Markdown Markdown is a plain-text writing format that converts to HTML. Learn the syntax rules, the CommonMark spec, GitHub Flavored Markdown and com
MD5 128-bit hash function, cryptographically broken since 2004 but still used for non-adversarial checksums.
Minifier Tool that strips whitespace and shortens code without changing its behavior, to reduce transfer size.

N

Notifications API The Notifications API lets a web page show system notifications after the user grants permission, using the Notification class or a service

O

OAuth 2.0 OAuth 2.0 is an authorization framework (RFC 6749) that lets apps get limited access to a user's data through tokens, without handling passw
Oklab Oklab is a perceptual color space with lightness L from 0 to 1 and a, b axes. CSS writes it as oklab() and uses it as the default interpolat
Open Graph Open Graph is a set of og: meta tags that tell social platforms the title, image and URL to show when someone shares a page link.
OTP (One-Time Pad) A one-time pad is a cipher that XORs the message with a truly random key of equal length, used once. It is the only cipher proven to have pe

P

Page Visibility API The Page Visibility API reports whether a page is visible or hidden through document.visibilityState and the visibilitychange event, so scri
Payment Request API The Payment Request API lets a web page ask the browser to collect payment details through a native payment sheet instead of a hand-built ch
Playfair Cipher The Playfair cipher encrypts pairs of letters using a 5x5 key square. It was the first practical digraph cipher, but it falls to modern cryp
Primary key A primary key is the column or columns whose values uniquely identify each row in a table, and it cannot repeat or be NULL in standard SQL.
PWA A PWA (Progressive Web App) is a website that can be installed and launched like an app, using a web app manifest, HTTPS and optional servic

R

Redis In-memory data store used as a cache, queue, or rate limiter, with strings, hashes, sets, and sorted sets.
Regex Pattern-matching mini-language for finding, validating, or extracting text.
REST REST (Representational State Transfer) is an architectural style for networked systems built from five constraints plus optional code-on-dem
RGB RGB describes a color as red, green and blue light amounts, each 0 to 255 on the web. 8 bits per channel give 16,777,216 colors.
robots.txt robots.txt is a plain-text file at a site's root that asks crawlers which URLs they may fetch. It is a request, not access control or a way
RSA RSA is a public-key algorithm for encryption and signatures based on factoring a large modulus. A 2048-bit key gives about 112 bits of secur

S

Salsa20 Salsa20 is a stream cipher by Daniel Bernstein with a 256-bit key, an 8-byte nonce and 64-byte blocks. ChaCha20 and XSalsa20 are variants of
Service worker A service worker is a script that runs in the background of a browser, intercepts network requests and caches responses so a site can work o
SHA-1 160-bit hash function, cryptographically broken since 2017 but still found in legacy systems.
SHA-256 256-bit hash from the SHA-2 family, the default modern checksum and password-adjacent hash function.
Source map A source map is a JSON file that links minified or compiled code back to the original source, so debuggers and stack traces show your real f
Speech Recognition Speech Recognition is the Web Speech API interface that converts microphone audio into text transcripts, with interim and final results and
Speech Synthesis Speech Synthesis is the browser text-to-speech API, window.speechSynthesis, that reads text aloud using voices supplied by the device or bro
SQL SQL (Structured Query Language) is the standard language for defining, querying and changing data in relational databases, specified as ISO/
SQLite SQLite is a serverless, file-based SQL database engine that runs inside your application, with a default 1 GB value limit and flexible colum
sRGB Standard RGB color space that defines what a color's numeric values actually look like on screen.
SSH key An SSH key is a public/private key pair that logs you in to a server over SSH without a password, usually made with ssh-keygen using Ed25519
Structured data Structured data is machine-readable markup, usually schema.org in JSON-LD, that tells search engines what a page contains and can unlock ric

T

Throttle Throttle limits how often a function runs, for example at most once every 100 ms, no matter how many times an event such as scroll fires.
TLS TLS (Transport Layer Security) encrypts and authenticates network connections. TLS 1.3 is now RFC 9846, and TLS 1.0 and 1.1 are deprecated.
TOML Minimal, explicitly typed config file format with `[section]` tables, used by Cargo and Python packaging.

U

Unicode Universal character standard assigning a unique code point to every character across the world's scripts.
Unix timestamp Count of seconds since 1970-01-01 00:00:00 UTC, the standard machine-readable absolute time.
URL API The URL API is the built-in URL class that parses a web address into parts such as host, pathname and search, and resolves relative links.
URL encoding Percent-encoding scheme that makes reserved and non-ASCII characters safe inside a URL.
URLSearchParams URLSearchParams is the built-in class that reads, edits and serializes URL query strings as an ordered list of name and value pairs.
UTC Coordinated Universal Time, the atomic-clock time standard with zero offset that all time zones are defined relative to.
UTF-8 Variable-length byte encoding for Unicode, backward compatible with 7-bit ASCII.
UUID 128-bit identifier, usually random, written as 32 hex digits in 8-4-4-4-12 groups.

V

Vigenere Cipher The Vigenere cipher shifts each letter by a repeating keyword, giving every letter position its own Caesar shift. It was broken in 1863 and

W

WCAG AA WCAG AA is the middle conformance level of the Web Content Accessibility Guidelines. For text it needs a 4.5:1 contrast ratio, or 3:1 for la
WCAG AAA WCAG AAA is the highest conformance level of the Web Content Accessibility Guidelines. Normal text needs a 7:1 contrast ratio and large text
Web Bluetooth Web Bluetooth is a browser API that lets a secure web page discover and talk to Bluetooth Low Energy devices through GATT services, after us
Web NFC Web NFC is a browser API that lets a web page read and write NFC tags that carry NDEF messages, currently shipped only in Chrome on Android.
Web Serial API Web Serial API lets a secure web page open a serial port the user picks and read and write bytes through streams, for microcontrollers and s
Web Share API The Web Share API opens the operating system share sheet from a web page so a user can send a title, text, URL or files to any installed app
WebGL WebGL (Web Graphics Library) is a JavaScript API for GPU-accelerated 2D and 3D graphics in a canvas, based on OpenGL ES 2.0, with WebGL 2 on
WebHID WebHID is a browser API that lets a secure web page read input reports from and send output reports to a Human Interface Device the user sel
Webhook A webhook is an HTTP request a service sends to your URL when an event happens, so you receive data pushed to you instead of polling.
WebSocket WebSocket is a protocol that opens a persistent two-way channel between browser and server over one TCP connection, defined in RFC 6455.
WebUSB WebUSB is a browser API that lets a secure web page talk to non-standard USB devices after the user picks the device from a browser permissi

X

X25519 X25519 is the Curve25519 Diffie-Hellman function from RFC 7748. It turns two 32-byte keys into a 32-byte shared secret and gives about 128-b
XML Tag-based markup format for structured data, validated by DTD/XSD schemas, used in configs and legacy APIs.
XSS XSS (cross-site scripting) is a vulnerability where untrusted input runs as script in another user's browser session on your site.

Y

YAML Indentation-based, human-readable data format common in config files, a superset of JSON since YAML 1.2.