Pronouncing Security Terms

cipher is pronounced "SY-fer" /ˈsaɪfər/ — two syllables, stress on the first, with a long /aɪ/ vowel ("sy," like "sigh") and the "ph" giving an /f/ sound, ending in schwa. So "choose a strong SY-fer", "the SY-fer suite." The "c" is soft (/s/) before "i." Do not say "SIFF-er" with a short vowel or use a hard "c." It means an encryption algorithm.

nonce is pronounced "nonce" /nɒns/ — one syllable, the /ɒ/ vowel as in "on," ending in /ns/, rhyming with the second half of "response." It is a cryptographic "number used once." So "include a nonce in the request", "the nonce prevents replay attacks." Do not add a syllable ("NON-see"). (Note: in British slang it has an unrelated offensive meaning, but in security it is just /nɒns/.)

salt is said "salt" /sɔːlt/ (or /sɒlt/) — one syllable, exactly like the table seasoning "salt." In security it means random data added to a password before hashing. So "add a salt to each password", "the salt is stored alongside the hash." It is the ordinary English word; the metaphor is "seasoning" the input so identical passwords hash differently. Do not spell it out.

hash is pronounced "hash" /hæʃ/ — one syllable, short /æ/ vowel (as in "cat"), ending in /ʃ/ ("sh"), exactly like the English word "hash" (chopped-up food, or the "#" symbol). So "store the password hash", "compute the SHA-256 hash." It is also a verb: "hash the input." Do not lengthen the vowel to "haysh" or spell it out.

SHA is most often said "shah" /ʃɑː/ — one syllable, like the Persian royal title "Shah," rhyming with "spa" — so "SHA-256" is "shah-two-fifty-six." Some spell it out "S-H-A." It stands for "Secure Hash Algorithm." So "hash it with shah-256", "use shah-512 instead." Do not say "shay" with a long "a." The vowel is the open /ɑː/ of "father."