Glossary Term

Shared Secret

More About Plurilock


White Paper: Advanced Authentication

The state of authentication today—and why you need Plurilock products.

Plurilock Quad Chart

Quick, visual summaries of Plurilock value, use cases, architecture, and typical clients.

2019 Authentication Guide

Summary of authentication recommendations from major standards bodies, plus Plurilock’s own recommendations.

Behavioral Biometrics Guide

The definitive guide to behavioral biometrics, a core Plurilock technology.

A Shared Secret is a static word, phrase, or string of characters agreed upon by two parties in order to confirm identity as a form of knowledge-based authentication (KBA). Passwords are the most common example of shared secrets; through initial password selection, a system and user "agree" that the next time the user attempts to log in, the system will prompt them for the chosen password and the user will provide it, and that if the user fails to provide it, they will not be logged in.¶"Secret questions" commonly seen in two-step authentication, such as "What is your mother's maiden name?" or "What was the name of your first pet?" are also instances of shared secrets frequently used for authentication purposes.¶Shared secret authentication is both particularly common and also particularly insecure, as the secrets are static, rather short for very practical reasons, often very easy to either brute force or to guess, and relatively easy to steal or lose, whether through phishing, various forms of snooping or interception, or user carelessness.

Stay informed. Join our low-volume list for news and updates.


Plurilock is the leader in advanced, risk-based authentication. We provide invisible, device-free MFA for corporate endpoints, Citrix sessions, cloud applications, and their users in finance, healthcare, education, and SaaS.



Contact Plurilock

Have a question or comment?