True/false vs positive/negative, explained
Every test gives one of two answers — "yes" or "no" — and reality is also one of two — "actually there" or "actually not". Pair them up and you get four outcomes: two where the test is right, two where it's wrong. Those are the true positive, true negative, false positive, and false negative — four words used everywhere, from smoke alarms to blood tests to spam filters.
This article puts all four in one 2×2 box, explains each corner in plain language, then shows the technical and the medical case. But one rule has to come first.
One rule first: mark what "positive" means
Before "true positive" means anything, you have to fix what counts as positive. Positive is the thing you're testing for: on a disease test, positive = "the patient is sick"; on a spam filter, positive = "this message is spam"; on a smoke alarm, positive = "there's a fire". Flip that definition and every true positive turns into a true negative.
Always mark what "positive" means first. Flip that one definition, and every true positive becomes a true negative.
So in every case below, the first sentence is always the same: positive here means…. Without it, the four boxes are meaningless.
Four boxes: true/false × positive/negative
Lay out two axes. Across: reality — the condition is actually present or not. Down: the test's call — positive or negative. Where they cross, you get four boxes.
Reading it is simple. The first word (true/false) says whether the test was right; the second word (positive/negative) says what the test said:
- True positiveⓘ — the test said "yes", and it was yes. Correct.
- True negativeⓘ — the test said "no", and it was no. Correct.
- False positiveⓘ — the test said "yes", but it was no. A false alarm.
- False negativeⓘ — the test said "no", but it was yes. A miss.
The whole table has a name: the confusion matrixⓘ. The correct diagonal (TP + TN) is where the test matches reality; the other two boxes are the two ways it can be wrong.
The technical view: cases
In software, all four boxes show up constantly — and each case starts by marking "positive":
- Spam filter — positive = "this message is spam". TP: spam lands in junk. FP: real email goes to junk too (annoying). FN: spam slips into the inbox. TN: real email reaches the inbox.
- Monitoring alert — positive = "something's wrong, fire the alarm". FP: the alarm fires while all is fine (a false alarm that wears the team out). FN: a real problem slips through with no alarm.
- Cookie
SameSite=Lax— positive = "the cookie is sent". Exactly the table in Cookie security: a legit link click is a true positive, a withheld CSRF request is a true negative.
| Case | "Positive" means | The costliest error |
|---|---|---|
| Spam filter | this message is spam | False positive — a real email is lost |
| Disease screening | the patient is sick | False negative — a missed diagnosis |
| Intrusion detection | this is an attack | False negative — an intruder gets through |
| Fraud block | this charge is fraud | False positive — a real card is declined |
The medical case: a disease screening test
In medicine, these four boxes carry real stakes. Positive = "the test says you have the disease".
- True positive — sick, and the test catches it. Treatment can start early.
- True negative — healthy, and the test says clear. Go home reassured.
- False positive — healthy, but the test says positive. A false alarm: needless worry and a follow-up test.
- False negative — sick, but the test says clear. This is the one to fear: the disease goes untreated.
That's why screening tests are measured by two numbers. Sensitivityⓘ is how rarely the test misses the sick (few false negatives); specificityⓘ is how rarely it wrongly flags the healthy (few false positives).
You can't zero out both
Here's the unavoidable trade-off: tune a test to miss less often (fewer false negatives), and it gets twitchier (more false positives). Tune it to be calmer (fewer false positives), and it misses more. You can't drive both to zero at once — you choose which error you can least afford.
The bottom line
Four outcomes, two axes: what the test says (positive/negative) against what reality is (true/false). True positive and true negative are right; a false positive is a false alarm, a false negative is a miss. But it all hangs on one step first — mark what "positive" means. Once that's clear, you just pick which error is costliest in your case.
For a software example that plays out in full, see the Lax case table in Cookie security: SameSite, HttpOnly, Secure.
Sources