TACACS+ packets use an encryption technique to encrypt client/server messages, and the encryption key is a pre-shared secret, or password, entered on both the client and server.
TACACS+ does not implement packet integrity checking, meaning packet capture and replay is a potential vulnerability, although the encryption limits the effectiveness of these attacks.