Pronouncing Security Acronyms

SAML is pronounced as a single word "SAM-el" /ˈsæməl/, rhyming with "camel" — two syllables, stress on the first, short /æ/ vowel. So "a SAML assertion", "SAM-el single sign-on." It is an acronym said as a word, not spelled out. Do not say "S-A-M-L" letter by letter or "say-mul" with a long vowel. It rhymes with the name "Samuel" shortened, or with "camel." This is standard in identity/SSO discussions.

JWT is commonly pronounced "jot" /dʒɒt/ — one syllable rhyming with "dot" — which is the pronunciation recommended in the JWT specification (RFC 7519). Alternatively many engineers spell it out as "J-W-T" /dʒeɪ ˌdʌblju ˈtiː/. So "send a jot in the header", or "the J-W-T payload." Both are professional and understood. The "jot" form is faster and is what the spec authors intended. Do not say "jew-it" or "jay-wit."

SSO is an initialism, always spelled out: "S-S-O" /ɛs ɛs oʊ/. So "enable S-S-O", "the S-S-O login", "S-S-O integration." Each letter is said: "ess, ess, oh." Never compress it into a word. The full expansion "Single Sign-On" is used when explaining the concept, but the abbreviation itself is always three letters. Compare with SAML, which is said as a word — but SSO is spelled out.

CORS is pronounced as the single word "cores" /kɔːrz/ — rhyming with "doors" and "scores." It is an acronym said as a word, not spelled out. So "a CORS error", "enable CORS", "the CORS policy." Do not say "C-O-R-S" letter by letter. It sounds identical to the plural "cores" (as in CPU cores) or very close to "course." In frontend debugging you will constantly hear "I am getting a CORS error" said as "a cores error."

WAF is commonly pronounced as a single word "waf" /wɑːf/ or /wæf/ — one syllable, rhyming with "off" or "laugh" depending on accent. So "put a WAF in front", "the WAF rules", "configure the WAF." Many engineers say it as a word rather than spelling out "W-A-F." Both forms are understood, but "waf" is faster and very common in cloud/security contexts (e.g. "AWS WAF" is "AWS waf").