the passive film
The passive film is the actual physical thing that passivation creates: an invisibly thin skin of oxide, only a few nanometers thick, that clings to certain metals and quietly does all the protecting. It is far too thin to see or feel — a stainless surface still looks like bare shiny metal — yet this gossamer layer is the entire reason stainless steel is stainless and aluminum does not dissolve. If you could scale a one-millimeter-thick sheet of steel up to a kilometer, its protective film would be about the thickness of a sheet of paper.
What makes a film protective rather than useless is its quality, not its thickness. A good passive film is dense, continuous, pore-free, and firmly bonded, so ions and water simply cannot get across it — on stainless steel it is a chromium-rich oxide (essentially Cr2O3), on aluminum it is alumina (Al2O3), on titanium it is titania (TiO2). Rust on ordinary iron is the opposite: it is bulky, cracked, and porous, so it flakes off and lets water reach fresh metal underneath, which is why iron keeps corroding while stainless does not. The film is also dynamic — it constantly reforms, and if scratched it re-grows in moments wherever oxygen is available, so the protection heals itself.
Understanding the film explains almost every rule of stainless behavior. You can make the film thicker and tougher on purpose: anodizing aluminum grows its natural film into a much thicker, harder, sometimes dyeable layer. You can strengthen a fresh stainless surface with a 'passivation treatment' (a nitric or citric acid dip that removes surface iron and lets a cleaner chromium film form). And you can predict failure: wherever the film is starved of oxygen (a crevice), locally dissolved (chloride pitting), or chemically stripped (a strong reducing acid), the metal underneath reverts to corroding fast. The passive film is a thin peace treaty between an active metal and a hostile world — and it only holds while its conditions are met.
Anodizing shows the film being engineered on purpose: aluminum is made the anode in an acid bath so its natural alumina film is grown deliberately to tens of micrometers, thick and hard enough to resist scratches and even hold a dye — the same protective oxide, just thickened and controlled.
Rust and a passive film are both metal oxides; the difference is a dense sealing skin versus a porous flaking crust.
It is a myth that a thicker oxide always protects better — bulky porous rust is thick and useless, while the invisible few-nanometer chromium film on stainless is what actually stops corrosion; density and adhesion, not thickness, decide protection.