Online safety glossary, in plain language

Thirty-two terms that turn up in this subject, defined by what they mean for a household rather than by what they mean in a specification.

Jargon in this subject does real damage, because a parent who does not recognise a word assumes the whole topic is beyond them and stops reading. Every entry below is written to be understood on the first pass, and where a precise technical definition would not change what anybody should do, it says what the thing means in practice instead.

The terms

Adware

Software that injects advertising into pages and applications. More often annoying than dangerous, and usually a sign that something was installed that should not have been.

Catfishing

Using invented photographs and details to build a relationship under a false identity. The persistent tell is a reason the camera never works.

Content maturity

Roblox's term for the level of content an account may reach. It functions as an age rating for a catalogue too large to vet title by title.

Credential stuffing

Trying passwords leaked from one service against many others, automatically. It is the reason reuse matters more than strength.

Cyberbullying

Repeated unpleasant behaviour carried out through messages, posts or games. The response order that works is screenshot, block, report, talk.

Data breach

When a company's stored account details escape. Ordinary, frequent, and not your fault. What turns one breach into five compromised accounts is a reused password.

Digital footprint

Everything findable about a person online: what they posted, what others posted about them, what is public by default, and what is attached invisibly such as location in a photograph.

Discoverability

Whether an account can be found by searching a phone number, email address or username. A separate switch from whether the posts are visible, and usually the one left on.

Doxxing

Publishing someone's private information (address, school, phone number) to expose them to harassment. It is usually assembled from fragments that were each individually public.

End-to-end encryption

A message readable only by sender and recipient, not by the service carrying it. Good for privacy, and it means a platform cannot see a message in order to moderate it.

Family Link

Google's supervision system for a child's Android account. Supervision follows the account, which is why it survives a new device and why an adult-age account cannot be supervised.

Family Pairing

TikTok's parental control system, which links a parent's account to a teenager's. It requires the teenager's device to set up, so it is something agreed rather than imposed.

Geotagging

Recording the location where a photograph was taken. It matters most for pictures taken at home or at a school, and it is off with one tap.

Grooming

A pattern in which an adult builds trust with a child online, moves the conversation somewhere private, and then asks for secrecy. That last step is the recognisable one.

HTTPS and the padlock

An encrypted connection between browser and site. It says the data in transit is private and nothing whatever about who is on the other end; a scam site can have one within minutes.

In-app purchase

Buying something inside an application, often with a currency bought earlier. Small amounts, repeated, are how money leaves a household through a child's device.

Loot box

A paid in-game item with randomised contents. Regulated as gambling in some countries and not in others; either way it is the mechanism behind most unexpected card statements.

Malware

Software that does something you did not agree to: it steals logins, shows adverts, or encrypts files. On a family device it almost always arrives through a download or an install rather than unaided.

Metadata

Information attached to a file, not visible in it: the time a photograph was taken, the device used, and often the location. Worth switching off in the camera app.

One-time code

The short number a service texts or generates to confirm it is you. It is the thing modern scam calls are after, and no legitimate organisation ever needs it read back to them.

Parental controls

The settings a platform provides for limiting content, contact, time and spending on a child's account. Free on every major platform, and attached to accounts rather than to hardware.

Passphrase

Several unrelated ordinary words used instead of a password. Long enough to defeat blind guessing, easy to type on a console, and not built from anything on a guessing list.

Password manager

An application, often already built into the browser or phone, that stores a different password for every account. Its quiet second benefit is that it will not fill your details into a look-alike site.

Phishing

A message pretending to be from an organisation you deal with, designed to get a password, a code or card details. The story changes weekly; the shape does not.

Ransomware

Malware that encrypts files and asks for payment. Rare on family devices and devastating on them, which is the argument for a backup nobody has to remember to make.

Restricted Mode

TikTok's filter for content that may not suit all audiences. A filter rather than a wall, and worth having alongside the conversation rather than instead of it.

Router

The box connecting a home to the internet. Worth visiting once to change its default administrator password and apply updates, then rarely again.

Screen Time

Apple's name for its parental control and usage system. Held shut by a passcode which should not be the same as the device's unlock code.

Sextortion

Threatening to share intimate images unless money or more images are provided. It is a crime, the victim is never in trouble, and speed of telling someone changes the outcome more than anything else.

Smishing

Phishing that arrives by text message rather than email. The same thing under a name that mostly exists so that people can tell them apart in reports.

Supervised account

A child's account on a service that a parent manages. On YouTube, a way for a child under thirteen to use the main app with a chosen content level.

Two-factor authentication

A second step after the password: usually a six-digit code or a prompt on your phone. It is the single most valuable setting on any account, because it makes a stolen password insufficient on its own. Turn it on for email first.

Why the wording matters more than usual here

Most of the vocabulary in online safety was invented by people describing attacks to other people who build systems. Carried over unchanged into advice for families, it produces the impression that the subject requires expertise, and that impression is the single biggest reason households do nothing at all.

Where a term matters enough to have its own page, the entry points there: the fuller treatments live in the threat library. So the test each entry has to pass is whether a reader could act differently after reading it. That rules out several words that appear on every other glossary of this kind, and it is why the definitions here are shorter and less precise than a technical reference would be. Readers who want the fuller beginner's treatment can still find it in the BBC's WebWise archive, which kept its plain-English register long after most technical glossaries gave up on it.