A security service determines whether to grant a user access to a resource. The service receives from the user a security term in an obscured form derived from a revealed form of the security term according to a predefined padding scheme known to the user and to the security service. The service applies the padding scheme to the received term to result in a de-padded security term and confirms that the de-padded security term matches the retrieved revealed security term. Additionally, the service confirms that the received term has not been previously employed within a predetermined frame of reference. Accordingly, if the received obscured security term is purloined and re-used within the predetermined frame of reference, the security service denies access to the resource.