The second part of a Kerberos principal. Techncially, it gives information which qualifies the primary. If the primary refers to a user, the instance is often left blank (and describes the user's credentials if not omitted). If the primary refers to a host, the instance is its complete hostname (such as "dolphin.upenn.edu").
The second part of a principal name, an instance qualifies the principal's primary. In the case of a service principal, the instance is required and is the host's fully qualified domain name, as in host/boston.eng.example.com. For user principals, an instance is optional. Note, however, that joe and joe/admin are unique principals. See also primary, principal name, service principal, user principal.