diff --git a/grub2/help/security_enable.html b/grub2/help/security_enable.html
index 22b135593..904c06ddd 100644
--- a/grub2/help/security_enable.html
+++ b/grub2/help/security_enable.html
@@ -1,3 +1,7 @@
 <header>Enable password protection</header>
-<p>Controls whether Webmin writes GRUB superuser password commands into the
-generated boot menu. Regenerate the GRUB menu after saving.</p>
+<p>When enabled, GRUB is configured with a superuser and a
+<tt>password_pbkdf2</tt> hash. This protects interactive editing and command
+line access at the boot menu.</p>
+<p>Boot entries that are marked <tt>--unrestricted</tt> can still be started
+without a password. The original password is not stored; only the GRUB PBKDF2
+hash is saved in the configured password script.</p>