Lately, there has been much confusion regarding the various terms describing the legitimacy of a Pokémon. This confusion has caused much unrest among WiFi traders in particular (for example, are cloned Pokémon really considered legitimate? If you use Pokésav to create a Pokémon within in-game boundaries, is it still considered a hack?). The main purpose of this page is to establish a standard set of definitions for these terms in order to eliminate any confusion surrounding them.
Definition - All Pokémon can be divided into two groups, legal and illegal. The group of legitimate Pokémon is a subset of the group of legal Pokémon - that is, legitimate Pokémon are always legal, but legal Pokémon aren't always legitimate.
Legal - (Valid) Pokémon are able to exist naturally in the game without the use of external devices.
Illegal - Pokémon are not able to exist naturally in the game without the use of external devices.
Legitimate - (Legit) Pokémon are created without the use of external devices. Because all of these Pokémon are also able to exist naturally in the game, legitimate Pokémon are a subset of legal Pokémon .
Although illegal Pokémon can only be created with the use of an external device (they simply cannot exist without the intervention of such a device), legal Pokémon can be created either naturally or through the intervention of an external device. Legitimate Pokémon, however, are always created naturally.
Because of the nature of these definitions, it is possible to check for the legality of the Pokémon, but impossible to check for legitimacy. Therefore, there is no objective way to tell whether a Pokémon is truly legitimate or not. Programs such as Legit Check and pAC can only check for legality, not legitimacy.
Examples - My Torterra, originating as a starter in the game and raised by hand (and never touched by an external device), would be considered legitimate.
A Spiritomb with Wonder Guard would be considered illegal, because Spiritombs cannot be assigned with the Wonder Guard ability without the use of an external device.
The 31/31/31/31/31/31 shiny docile Umbreon from the PKM Database would be considered legal because it was created with the use of external devices, but could exist in the game without the use of external devices. Although it would be extremely rare to encounter such a Pokémon, all aspects of its data (its moveset, PID/IV combination, location caught, 85h, etc.) could have been generated by the game naturally.
Diagram - This diagram by tsanth summarizes the definitions on this page:
Credits go to: www.pokesav.org