Cryptographic key vs Password

Why they differ

A password is chosen and remembered by a person; a key is a long random value made and stored by a machine.

Cryptography

The secret value that decides how data is scrambled and restored - whoever holds it can read the protected data.

Formal

A long, randomly chosen value fed into an encryption or signing method. The method itself is public, so all of the protection rests on keeping the right key secret and on it being too long to guess.

In plain English

Like the key to a padlock - everyone knows how padlocks work, but only the person with the right key can open this one.

In practice

The IT operations lead at a pension fund keeps the keys for its encrypted backups in a separate, locked-down system, so an attacker who gets hold of the backups does not also get the keys.

Why it matters

Encryption is only as strong as the care taken with its keys; a lost key means lost data, and a leaked key means no protection at all.

Password

Identity & access

A secret string of characters, known only to the user, typed in to prove they are who they claim to be.

Formal

A memorised secret used as a credential in authentication. The system should store it only in a scrambled form that cannot be turned back, so that not even the system itself can read it.

In plain English

Like a secret knock agreed with a friend - it works only while nobody else knows it, and it is useless once someone has overheard it.

In practice

Following NIST guidance, the IT manager at a small Danish company stops forcing password changes every 90 days and instead requires long passphrases, checked against lists of known leaked passwords.

Why it matters

Passwords are easy to guess, use again and trick out of people with phishing, so on their own they are weak - that weakness is why MFA exists.