PFS (perfect forward secrecy)
also: Forward Secrecy, FS, ephemeral key exchange
Perfect Forward Secrecy is a cryptographic property ensuring that even if a server's long-term private key is compromised, previously encrypted session communications remain secure because each session uses unique, temporary encryption keys.
Perfect Forward Secrecy (PFS) protects past encrypted conversations from being decrypted if a server's main private key is stolen or leaked in the future. This is achieved by generating a new, unique key pair for each TLS/SSL session that is discarded after the session ends.
Without PFS, an attacker who obtains a server's private key can decrypt all past traffic they've captured. With PFS enabled, they cannot—each session's encryption is independent and temporary. For example, HTTPS connections using PFS-enabled cipher suites (like those with ECDHE or DHE) generate ephemeral Diffie-Hellman keys that exist only for that session.
Modern web servers and browsers negotiate PFS-capable cipher suites by default. You can verify PFS support by checking your server's TLS configuration or using tools like sslscan or openssl s_client to inspect the key exchange method used.