IT lexicon › Security › Session key

Session key

Security På svenska → Updated: 2026-10-12

A key that protects a single session and is discarded when it ends.

A session key encrypts the traffic of one connection, such as a TLS session, and is thrown away when the session closes. It is usually agreed with a key exchange such as Diffie–Hellman. With forward secrecy, the key cannot be reconstructed even from the long-term keys, and a leaked session key only exposes that one session.

A session key is only as secret as the way it was generated, though. A weak random number generator or a nonce reused by mistake can make keys predictable, which has happened in real systems.

← Back to the lexicon