A shibboleth (/ˈʃɪbəlɛθ, -ɪθ/ ^ⓘ SHIB-əl-eth, -⁠ith; Hebrew: שִׁבֹּלֶת [ʃiˈbolet]) is any custom or tradition—usually a choice of phrasing or single word—that distinguishes one group of people from another. Historically, shibboleths have been used as passwords, ways of self-identification, signals of loyalty and affinity, ways of maintaining traditional segregation, or protection from threats. It has also come to mean a moral formula held tenaciously and unreflectingly.

The term originates from the Hebrew word shibbóleth (שִׁבֹּלֶת), which means the part of a plant containing grain, such as the ear of a stalk of wheat or rye; or less commonly (but arguably more appropriately) 'flood, torrent'.

The modern use derives from an account in the Hebrew Bible, in which pronunciation of this word was used to distinguish Ephraimites, whose dialect used a different first consonant. The difference concerns the Hebrew letter shin, which is now pronounced as /ʃ/ (as in shoe). In the Book of Judges chapter 12, after the inhabitants of Gilead under the command of Jephthah inflicted a military defeat upon the invading tribe of Ephraim (around 1370–1070 BC), the surviving Ephraimites tried to cross the river Jordan back into their home territory, but the Gileadites secured the river's fords to stop them. To identify and kill these Ephraimites, the Gileadites told each suspected survivor to say the word shibboleth. The Ephraimite dialect resulted in a pronunciation that, to Gileadites, sounded like sibboleth. In Judges 12:5–6 in the King James Bible, the anecdote appears thus (with the word already in its current English spelling):

And the Gileadites took the passages of Jordan before the Ephraimites: and it was so, that when those Ephraimites which were escaped said, Let me go over; that the men of Gilead said unto him, Art thou an Ephraimite? If he said, Nay;

Then said they unto him, Say now Shibboleth: and he said Sibboleth: for he could not frame to pronounce it right. Then they took him, and slew him at the passages of Jordan: and there fell at that time of the Ephraimites forty and two thousand.

— Judges 12:5–6

Shibboleth has been described as the first "password" in Western literature but exactly how it worked is not known; it has long been debated by scholars of Semitic languages. It may have been quite subtle: the men of Ephraim were unlikely to be "caught totally napping by any test that involved some gross and readily detectable difference of pronunciation"; On a superficial reading the fleeing Ephraimites were betrayed by their dialect: they said sibbōlet. But it has been asked why they did not simply repeat what the Gileadite sentries told them to say – "they surely would have used the required sound to save their necks", since peoples in the region could say both "sh" and "s". "We have yet to learn how the suspects were caught by the catchword". A related problem (akin to false positives) is how the test spared neutral tribes with whom the Gileadite guards had no quarrel, yet pinpointed the Ephraimite enemy.

Ephraim Avigdor Speiser therefore proposed that the test involved a more challenging sound than could be written down in the later biblical Hebrew narrative, namely the phoneme ⟨θ⟩ (≈ English "th"). Present in archaic Hebrew (said Speiser) but later lost in most dialects, the Gileadites, who lived across a dialect boundary (the river Jordan), had retained it in theirs. Thus, what the Gileadite guards would have demanded was the password thibbōlet. The phoneme is difficult for naive users – to this day, wrote Speiser, most non-Arab Muslims cannot pronounce the classical Arabic equivalent – hence the best the Ephraimite refugees could manage was sibbōlet. Speiser's solution has had a mixed reception, but has been revived by Gary A. Rendsburg.